From 881e49f15ab57df7df7f289223a5588713815052 Mon Sep 17 00:00:00 2001 From: Eric Conrad Date: Thu, 7 Sep 2017 20:06:23 -0400 Subject: [PATCH] Update DeepWhite.md --- DeepWhite.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/DeepWhite.md b/DeepWhite.md index 6958886..f612e19 100644 --- a/DeepWhite.md +++ b/DeepWhite.md @@ -28,7 +28,7 @@ Sysmon is required: https://docs.microsoft.com/en-us/sysinternals/downloads/sysm Must log the SHA256 hash, DeepWhite will ignore the others. -This minimal Sysmon 6.0 config will log the proper events/hashes: +This minimal Sysmon 6.0 config will log the proper events/hashes. Note that image (DLL) logging may create performance issues. This config ignores DLLs signed by Microsoft (which should lighten the load), but please test! ```xml @@ -41,6 +41,7 @@ This minimal Sysmon 6.0 config will log the proper events/hashes: windows + microsoft windows @@ -56,7 +57,7 @@ These are the events used by DeepBlueCLI and DeepWhite. You can go *much* further than this with Sysmon. The Sysinternals Sysmon page has a good basic configuration: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon -Also see @swiftonsecurity's awesome sysmon config here: https://github.com/SwiftOnSecurity/sysmon-config +Also see @swiftonsecurity's awesome Sysmon config here: https://github.com/SwiftOnSecurity/sysmon-config ## Generating a Whitelist