n0dec / malwless Goto Github PK

Version 13 of sysmon isn't supported, would appreciate if some support would be added so I can test some new rulesets :)

Love the project.

I'm getting errors for sysmon13.01, not sure if this is impacting, but I'm not seeing the events being inserted. The powershell ones are being inserted.

PS C:\Users\pixelnull\Desktop\malwless> .\malwless.exe

MalwLess Simulation Tool v2.4
Author: @n0dec
Site: https://github.com/n0dec/MalwLess

Sysmon version: 13.01
Using file 'rule_test.json'

[Rule test name]: MalwLess default
[Rule test version]: 0.3
[Rule test author]: n0dec
[Rule test description]: MalwLess default test pack.

[>] Detected rule: rules.vssadmin_delete_shadows
... Source: Sysmon
... Category: Process Create
... Description: Deleted shadows copies via vssadmin.
[!] Error: Sysmon version not supported.
[>] Detected rule: rules.certutil_network_activity
... Source: Sysmon
... Category: Network connection detected
... Description: Network activity from certutil tool.
[!] Error: Sysmon version not supported.
[>] Detected rule: rules.powershell_scriptblock
... Source: PowerShell
... Category: 4104
... Description: Powershell 4104 event for Invoke-Mimikatz.

Not sure if you still maintain this project, but WinPwnage received tons of updates since your last PR