From 56cc5e6aacc84ec699d923888496a8fc7b73c2a0 Mon Sep 17 00:00:00 2001
From: Kevin De Notariis <68190090+KevinDeNotariis@users.noreply.github.com>
Date: Wed, 7 Apr 2021 15:35:30 +0200
Subject: [PATCH] Monitor for .js files for Microsoft JScript

---
 sysmonconfig-export.xml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index f4acf26c..966bf69b 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -482,6 +482,7 @@
 			<TargetFilename condition="end with">.jar</TargetFilename> <!--Java applets-->
 			<TargetFilename condition="end with">.jnlp</TargetFilename> <!--Java applets-->
 			<TargetFilename condition="end with">.jse</TargetFilename> <!--Scripting [ Example: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~Phires-C/detailed-analysis.aspx ] -->
+			<TargetFilename condition="end with">.js</TargetFilename> <!-- Microsoft JScript -->
 			<TargetFilename condition="end with">.hta</TargetFilename> <!--Scripting-->
 			<TargetFilename condition="end with">.job</TargetFilename> <!--Scheduled task-->
 			<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
@@ -794,6 +795,7 @@
 			<TargetFilename condition="end with">.ps1</TargetFilename> <!--PowerShell-->
 			<TargetFilename condition="end with">.ps2</TargetFilename> <!--PowerShell-->
 			<TargetFilename condition="end with">.reg</TargetFilename> <!--Registry File-->
+			<TargetFilename condition="end with">.js</TargetFilename> <!-- Microsoft JScript -->
 			<TargetFilename condition="end with">.jse</TargetFilename> <!--Registry File-->
 			<TargetFilename condition="end with">.vb</TargetFilename> <!--VisualBasicScripting files-->
 			<TargetFilename condition="end with">.vbe</TargetFilename> <!--VisualBasicScripting files-->
@@ -1156,4 +1158,4 @@
 		<!--Cannot be filtered.-->
 
 	</EventFiltering>
-</Sysmon>
\ No newline at end of file
+</Sysmon>