fixed issue with identifying proper node

darkoperator · darkoperator · commit 3f7c26894f02 · 2018-09-20T18:25:13.000-04:00
Updated Function for RuleName
diff --git a/Functions/New-SysmonCreateRemoteThreadFilter.ps1 b/Functions/New-SysmonCreateRemoteThreadFilter.ps1
@@ -74,7 +74,7 @@ function New-SysmonCreateRemoteThreadFilter {
         if($RuleName) {
             $cmdoptions.Add('RuleName',$RuleName)
         }
-        
+
         switch($psCmdlet.ParameterSetName) {
             'Path' {
                 $cmdOptions.Add('Path',$Path)
diff --git a/Functions/New-SysmonPipeFilter.ps1 b/Functions/New-SysmonPipeFilter.ps1
@@ -81,7 +81,7 @@ function New-SysmonPipeFilter {
         if($RuleName) {
             $cmdoptions.Add('RuleName',$RuleName)
         }
-        
+
         switch ($PSCmdlet.ParameterSetName) {
             'Path' {
                 $cmdOptions.Add('Path',$Path)
diff --git a/Posh-SysMon.psm1 b/Posh-SysMon.psm1
@@ -257,9 +257,9 @@ function New-RuleFilter
         } # If only one element this will return null, more than one this will provide a value.
         else
         {
-            if ($RuleData.count -eq $null)
+            if ($RuleData.count -eq 1)
             {
-                if ($RuleData.onmatch -eq $OnMatch)
+                if ($RuleData.Attributes."#text" -eq $OnMatch)
                 {
                     Write-Verbose -Message 'Single node.'
                     Write-Verbose -Message "Creating filters for event type $($EventType)."

Original file line number	Diff line number	Diff line change
`@@ -74,7 +74,7 @@ function New-SysmonCreateRemoteThreadFilter {`
`74`	`74`	`if($RuleName) {`
`75`	`75`	`$cmdoptions.Add('RuleName',$RuleName)`
`76`	`76`	`}`
`77`		`-`
	`77`	`+`
`78`	`78`	`switch($psCmdlet.ParameterSetName) {`
`79`	`79`	`'Path' {`
`80`	`80`	`$cmdOptions.Add('Path',$Path)`
Original file line number	Diff line number	Diff line change
`@@ -81,7 +81,7 @@ function New-SysmonPipeFilter {`
`81`	`81`	`if($RuleName) {`
`82`	`82`	`$cmdoptions.Add('RuleName',$RuleName)`
`83`	`83`	`}`
`84`		`-`
	`84`	`+`
`85`	`85`	`switch ($PSCmdlet.ParameterSetName) {`
`86`	`86`	`'Path' {`
`87`	`87`	`$cmdOptions.Add('Path',$Path)`
Original file line number	Diff line number	Diff line change
`@@ -257,9 +257,9 @@ function New-RuleFilter`
`257`	`257`	`} # If only one element this will return null, more than one this will provide a value.`
`258`	`258`	`else`
`259`	`259`	`{`
`260`		`- if ($RuleData.count -eq $null)`
	`260`	`+ if ($RuleData.count -eq 1)`
`261`	`261`	`{`
`262`		`- if ($RuleData.onmatch -eq $OnMatch)`
	`262`	`+ if ($RuleData.Attributes."#text" -eq $OnMatch)`
`263`	`263`	`{`
`264`	`264`	`Write-Verbose -Message 'Single node.'`
`265`	`265`	`Write-Verbose -Message "Creating filters for event type $($EventType)."`