Skip to content

Commit 37aa307

Browse files
Re-merge conflicting merges
1 parent 2a9f06a commit 37aa307

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

sysmonconfig-export.xml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -354,6 +354,9 @@
354354
<DestinationHostname condition="end with">.microsoft.com</DestinationHostname> <!--Microsoft:Update delivery-->
355355
<DestinationHostname condition="end with">microsoft.com.akadns.net</DestinationHostname> <!--Microsoft:Update delivery-->
356356
<DestinationHostname condition="end with">microsoft.com.nsatc.net</DestinationHostname> <!--Microsoft:Update delivery-->
357+
<!--Section: Loopback Addresses-->
358+
<DestinationIp condition="is">127.0.0.1</DestinationIp> <!--Credit @ITProPaul-->
359+
<DestinationIp condition="begin with">fe80:0:0:0</DestinationIp> <!--Credit @ITProPaul-->
357360
</NetworkConnect>
358361
</RuleGroup>
359362

@@ -470,6 +473,7 @@
470473
<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting: Batch scripts can also use the .cmd extension | Credit: @mmazanec -->
471474
<TargetFilename condition="end with">.cmdline</TargetFilename> <!--Microsoft:dotNet: Executed by cvtres.exe-->
472475
<TargetFilename name="T1176" condition="end with">.crx</TargetFilename> <!--Chrome extension-->
476+
<TargetFilename condition="end with">.dmp</TargetFilename> <!--Process dumps [ (fr) http://blog.gentilkiwi.com/securite/mimikatz/minidump ] -->
473477
<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
474478
<TargetFilename name="DLL" condition="end with">.dll</TargetFilename> <!--Microsoft:Office:Word: Macro-->
475479
<TargetFilename name="EXE" condition="end with">.exe</TargetFilename> <!--Executable-->

0 commit comments

Comments
 (0)