ultra.xml

<Sysmon schemaversion="4.50">
	<HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms>
	<CheckRevocation/>
	<EventFiltering>
		<RuleGroup name="" groupRelation="or">
			<ProcessCreate onmatch="exclude"></ProcessCreate>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<FileCreateTime onmatch="include"></FileCreateTime>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<NetworkConnect onmatch="exclude"></NetworkConnect>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<ProcessTerminate onmatch="exclude"></ProcessTerminate>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<DriverLoad onmatch="exclude">
				<Signature condition="contains">microsoft</Signature>
				<Signature condition="contains">windows</Signature>
				<Signature condition="begin with">Intel </Signature>
			</DriverLoad>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<ImageLoad onmatch="exclude"></ImageLoad>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<CreateRemoteThread onmatch="exclude">
			</CreateRemoteThread>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<RawAccessRead onmatch="include">
			</RawAccessRead>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<ProcessAccess onmatch="exclude">
			</ProcessAccess>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<FileCreate onmatch="exclude"></FileCreate>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<RegistryEvent onmatch="exclude"></RegistryEvent>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<FileCreateStreamHash onmatch="include"></FileCreateStreamHash>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<PipeEvent onmatch="include"></PipeEvent>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<WmiEvent onmatch="exclude"></WmiEvent>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<DnsQuery onmatch="exclude"></DnsQuery>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<ProcessTampering onmatch="exclude"></ProcessTampering>
		</RuleGroup>
		<RuleGroup name="" groupRelation="or">
			<ClipboardChange onmatch="include"></ClipboardChange>
		</RuleGroup>
	</EventFiltering>
</Sysmon>