https://github.com/mattifestation/PSSysmonTools

Sysmon Tools for PowerShell
https://github.com/mattifestation/PSSysmonTools

Last synced: 22 days ago
JSON representation

Sysmon Tools for PowerShell

• Host: GitHub
• URL: https://github.com/mattifestation/PSSysmonTools
• Owner: mattifestation
• License: bsd-3-clause
• Archived: true
• Created: 2017-12-25T15:39:12.000Z (almost 7 years ago)
• Default Branch: master
• Last Pushed: 2018-08-17T13:35:18.000Z (over 6 years ago)
• Last Synced: 2024-08-05T17:33:45.705Z (4 months ago)
• Language: PowerShell
• Size: 3.13 MB
• Stars: 231
• Watchers: 25
• Forks: 52
• Open Issues: 2
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-hacking-lists - mattifestation/PSSysmonTools - Sysmon Tools for PowerShell (PowerShell)

README

        
# PSSysmonTools

Sysmon Tools for PowerShell

## Implemented functions

### Get-SysmonConfiguration

Parses a Sysmon driver configuration from the registry. Output is nearly identical to that of "sysmon.exe -c" but without the requirement to run sysmon.exe.

### ConvertFrom-SysmonBinaryConfiguration

Parses a binary Sysmon configuration. ConvertFrom-SysmonBinaryConfiguration is designed to serve as a helper function for Get-SysmonConfiguration.

### Test-SysmonConfiguration

Validates a Sysmon configuration.

### ConvertTo-SysmonXMLConfiguration

Recovers a Sysmon XML configuration from a binary configuration.

### Merge-SysmonXMLConfiguration

Merges one or more Sysmon XML configurations.

Please refer to built-in help for each function for more information.

## Notes

These PowerShell functions will need to be manually validated for each new Sysmon and configuration schema version. Please report all bugs and indiscrepencies with new versions by supplying the following information:

1) The Sysmon config XML that's generating the error (only schema versions 3.40 and later).

2) The version of Sysmon being used (only 6.20 and later).

Also, please file feature requests in the form of GitHub issues! Thank you!