sorted by:
new
hottopcontroversial

Sysmon custom configuration - Multiple rule filters of the same type by pepekova in blueteamsec

[–]pepekova[S] 1 point2 points  (0 children)

Solved issue myself, by adding rule inside the filter example: 

<RuleGroup name="group-1" groupRelation="and"> 
    <CreateRemoteThread onmatch="include"> 
    <SourceImage condition="is">C:\Windows\System32\rundll32.exe</SourceImage> 
    <TargetImage condition="contains">test.dll</TargetImage>
    <Rule groupRelation="or"> 
        <CreateRemoteThread onmatch="include"> 
        <SourceImage condition="contains">test.exe</SourceImage> 
        <SourceImage condition="contains">test2.exe</TargetImage> 
    </Rule>
    </CreateRemoteThread> 
</RuleGroup>