Cyberdefense/DeepBlueCLI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update DeepWhite.md

Browse Source
This commit is contained in:
Eric Conrad
2017-09-07 20:06:23 -04:00
committed by GitHub
parent 2a8f71fdac
commit 881e49f15a
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
DeepWhite.md
View File

@ -28,7 +28,7 @@ Sysmon is required: https://docs.microsoft.com/en-us/sysinternals/downloads/sysm
Must log the SHA256 hash, DeepWhite will ignore the others. Must log the SHA256 hash, DeepWhite will ignore the others.
This minimal Sysmon 6.0 config will log the proper events/hashes: This minimal Sysmon 6.0 config will log the proper events/hashes. Note that image (DLL) logging may create performance issues. This config ignores DLLs signed by Microsoft (which should lighten the load), but please test!
```xml ```xml
<Sysmon schemaversion="3.3"> <Sysmon schemaversion="3.3">
@ -41,6 +41,7 @@ This minimal Sysmon 6.0 config will log the proper events/hashes:
<Signature condition="contains">windows</Signature> <Signature condition="contains">windows</Signature>
</DriverLoad> </DriverLoad>
<!-- Log all images (.dll) except if the signature contains Microsoft or Windows --> <!-- Log all images (.dll) except if the signature contains Microsoft or Windows -->
<!-- Note: this may create a performance issue, please test -->
<ImageLoad onmatch="exclude"> <ImageLoad onmatch="exclude">
<Signature condition="contains">microsoft</Signature> <Signature condition="contains">microsoft</Signature>
<Signature condition="contains">windows</Signature> <Signature condition="contains">windows</Signature>
@ -56,7 +57,7 @@ These are the events used by DeepBlueCLI and DeepWhite.
You can go *much* further than this with Sysmon. The Sysinternals Sysmon page has a good basic configuration: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon You can go *much* further than this with Sysmon. The Sysinternals Sysmon page has a good basic configuration: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Also see @swiftonsecurity's awesome sysmon config here: https://github.com/SwiftOnSecurity/sysmon-config Also see @swiftonsecurity's awesome Sysmon config here: https://github.com/SwiftOnSecurity/sysmon-config
## Generating a Whitelist ## Generating a Whitelist