Using Sysmon to Block Unwanted Files and Send Notifications to Slack via Scheduled Task Event Filter

00:00 - Intro
01:10 - Installing Sysmon and the configuration from Neo23x0's Repo
02:00 - Explaining the file blocked section
04:00 - Viewing the Sysmon log to confirm it is installed and see its EvendID 27
05:10 - Creating a Scheduled Task with Event Filter to trigger on Sysmon File Blocked Events
07:30 - Event did fire turns out it is case sensitive
08:50 - Editing the Scheduled Task event by hand to add ValueQueries which allows arguments to be sent from this Event Filter
11:30 - Testing the passing of variables by adding them to the message box
12:50 - Start of creating some powershell to send this message to Slack
16:30 - Have trouble getting arguments into the powershell script because of Base64 Endcoding, change up our script
23:10 - Showing a working copy of the powershell script that sends slack messages
25:45 - Deploying our scheduled task through Group Policy
28:50 - Editing the scheduled task XML file from sysvol

[@domiflichi]

Thanks for the video! I love how you don't edit out the problems you run into - it's very helpful to see how you work through them. Thanks again, and keep them coming!

[@podavu7044]

i m watching all your videos and your content is just amazing !
thank you for the efforts that you are putting u re really helping a lot of people out there.

[@ShahabSheikhzadeh]

This is the most beautiful thing I've ever seen. I love You

[@ich3aa]

"Wait a second, it worked! It shouldn't happen !" That sums it all for me

[@kristeinsalmath1959]

This is amazing.

[@DJ-rr7cj]

This is SO COOL!

[@inhhoanghai5263]

Good Content !!!

[@dolbysuper8563]

wo! thanx

[@SomeGuyInSandy]

Awesome! Thanks!

[@RomainRollot]

Top ! Thanks

[@anonymoususer6801]

You can send any message from any user with the token not sure if that's a risk.

[@ippsec]

There's no way to really get around that, it's limited to sending messages and to the channel.

[@ratchy1231]

Is this approach vulnerable to command injection? If an attacker is capable of controlling the filename they could attempt to write to: "&& malicious_command && exit", which should also prevent the Slack notification from coming through.

[@ippsec]

You should try it out. I did try it briefly and it didn't work but I didn't spend a lot of time on it.

[@MoisheHalberstam]

Can you Please upload the script for the slack webhook and a export from the task scheduler to GitHub?
Id love to not have to retype the whole thing ;-}

[@marcpascualsole7677]

If YMS was a hacker, you'd have Ippsec