Cyberdefense/DeepBlueCLI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update DeepWhite.md

Browse Source
This commit is contained in:
Eric Conrad
2017-09-07 20:06:23 -04:00
committed by GitHub
parent 2a8f71fdac
commit 881e49f15a
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
DeepWhite.md
View File

@ -28,7 +28,7 @@ Sysmon is required: https://docs.microsoft.com/en-us/sysinternals/downloads/sysm
Must log the SHA256 hash, DeepWhite will ignore the others.
This minimal Sysmon 6.0 config will log the proper events/hashes:
This minimal Sysmon 6.0 config will log the proper events/hashes. Note that image (DLL) logging may create performance issues. This config ignores DLLs signed by Microsoft (which should lighten the load), but please test!
```xml
<Sysmon schemaversion="3.3">
@ -41,6 +41,7 @@ This minimal Sysmon 6.0 config will log the proper events/hashes:
<Signature condition="contains">windows</Signature>
</DriverLoad>
<!-- Log all images (.dll) except if the signature contains Microsoft or Windows -->
<!-- Note: this may create a performance issue, please test -->
<ImageLoad onmatch="exclude">
<Signature condition="contains">microsoft</Signature>
<Signature condition="contains">windows</Signature>
@ -56,7 +57,7 @@ These are the events used by DeepBlueCLI and DeepWhite.
You can go *much* further than this with Sysmon. The Sysinternals Sysmon page has a good basic configuration: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Also see @swiftonsecurity's awesome sysmon config here: https://github.com/SwiftOnSecurity/sysmon-config
Also see @swiftonsecurity's awesome Sysmon config here: https://github.com/SwiftOnSecurity/sysmon-config
## Generating a Whitelist