主页 / user-1087187

adsl's questions

Martin Hope
adsl
Asked: 2019-09-11 03:19:53 +0800 CST
  • 5

我使用 Sysmon 进行网络监控，但不是监控我请求的所有目的地，它只监控特定的目的地，而其余的则不受监控。我会解释 - 为了监控 google 和 github 访问，我编写了下一个配置：

<Sysmon schemaversion="4.21">
<HashAlgorithms>*</HashAlgorithms>
<CheckRevocation/>
<EventFiltering>
    <RuleGroup name="" groupRelation="or"><NetworkConnect onmatch="include">
        <DestinationHostname condition="contains">google.com</DestinationHostname>
        <DestinationHostname condition="contains">.github.com</DestinationHostname>
    </NetworkConnect></RuleGroup>
    <RuleGroup name="" groupRelation="or"><DnsQuery onmatch="include"></DnsQuery></RuleGroup>
    <RuleGroup name="" groupRelation="or"><ProcessCreate onmatch="include"></ProcessCreate></RuleGroup>
    <RuleGroup name="" groupRelation="or"><FileCreateTime onmatch="include"></FileCreateTime></RuleGroup>
    <RuleGroup name="" groupRelation="or"><ProcessTerminate onmatch="include"></ProcessTerminate></RuleGroup>
    <RuleGroup name="" groupRelation="or"><DriverLoad onmatch="include"></DriverLoad></RuleGroup>
    <RuleGroup name="" groupRelation="or"><ImageLoad onmatch="include"></ImageLoad></RuleGroup>
    <RuleGroup name="" groupRelation="or"><CreateRemoteThread onmatch="include"></CreateRemoteThread></RuleGroup>
    <RuleGroup name="" groupRelation="or"><RawAccessRead onmatch="include"></RawAccessRead></RuleGroup>
    <RuleGroup name="" groupRelation="or"><ProcessAccess onmatch="include"></ProcessAccess></RuleGroup>
    <RuleGroup name="" groupRelation="or"><FileCreate onmatch="include"></FileCreate></RuleGroup>
    <RuleGroup name="" groupRelation="or"><RegistryEvent onmatch="include"></RegistryEvent></RuleGroup>
    <RuleGroup name="" groupRelation="or"><FileCreateStreamHash onmatch="include"></FileCreateStreamHash></RuleGroup>
    <RuleGroup name="" groupRelation="or"><PipeEvent onmatch="include"></PipeEvent></RuleGroup>
    <RuleGroup name="" groupRelation="or"><WmiEvent onmatch="include"></WmiEvent></RuleGroup>
</EventFiltering>

并运行它

sysmon -i C:\temp\sysmon\config.xml -accepteula

接下来，我进入了 google.com 和 github.com，并检查了我的事件查看器的结果。Sysmon 咳嗽的唯一结果是来自 github.com，但没有来自 google.com 的活动被记录到事件日志中（总是这种情况，它同意监控 github 但不会监控 google）

我错过了什么？为什么我不能监控任何网站，有没有办法绕过它？

非常感谢！！！

networking monitoring