Skip to content

Commit 4be02d1

Browse files
committed
Added powershell_ise.exe to the list of Network connection monitoring
1 parent 1228d37 commit 4be02d1

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

sysmonconfig-export.xml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,8 @@
300300
<Image condition="image">net1.exe</Image> <!--Windows: Launched by "net.exe", but it may not detect connections either -->
301301
<Image condition="image">notepad.exe</Image> <!--Windows: [ https://secrary.com/ReversingMalware/CoinMiner/ ] [ https://blog.cobaltstrike.com/2013/08/08/why-is-notepad-exe-connecting-to-the-internet/ ] -->
302302
<Image condition="image">nslookup.exe</Image> <!--Windows: Retrieve data over DNS -->
303-
<Image condition="image">powershell.exe</Image> <!--Windows: PowerShell interface-->
303+
<Image condition="image">powershell.exe</Image> <!--Windows: PowerShell interface-->
304+
<Image condition="image">powershell_ise.exe</Image> <!--Windows: PowerShell interface-->
304305
<Image condition="image">qprocess.exe</Image> <!--Windows: [ https://www.first.org/resources/papers/conf2017/APT-Log-Analysis-Tracking-Attack-Tools-by-Audit-Policy-and-Sysmon.pdf ] -->
305306
<Image condition="image">qwinsta.exe</Image> <!--Windows: Query remote sessions | Credit @ion-storm -->
306307
<Image condition="image">qwinsta.exe</Image> <!--Windows: Remotely query login sessions on a server or workstation | Credit @ion-storm -->

0 commit comments

Comments
 (0)