Video není dostupné.
Omlouváme se.
Using Sysmon to Block Unwanted Files and Send Notifications to Slack via Scheduled Task Event Filter
Vložit
- čas přidán 18. 08. 2024
- 00:00 - Intro
01:10 - Installing Sysmon and the configuration from Neo23x0's Repo
02:00 - Explaining the file blocked section
04:00 - Viewing the Sysmon log to confirm it is installed and see its EvendID 27
05:10 - Creating a Scheduled Task with Event Filter to trigger on Sysmon File Blocked Events
07:30 - Event did fire turns out it is case sensitive
08:50 - Editing the Scheduled Task event by hand to add ValueQueries which allows arguments to be sent from this Event Filter
11:30 - Testing the passing of variables by adding them to the message box
12:50 - Start of creating some powershell to send this message to Slack
16:30 - Have trouble getting arguments into the powershell script because of Base64 Endcoding, change up our script
23:10 - Showing a working copy of the powershell script that sends slack messages
25:45 - Deploying our scheduled task through Group Policy
28:50 - Editing the scheduled task XML file from sysvol
Thanks for the video! I love how you don't edit out the problems you run into - it's very helpful to see how you work through them. Thanks again, and keep them coming!
i m watching all your videos and your content is just amazing !
thank you for the efforts that you are putting u re really helping a lot of people out there.
This is the most beautiful thing I've ever seen. I love You
"Wait a second, it worked! It shouldn't happen !" That sums it all for me
This is amazing.
This is SO COOL!
Good Content !!!
wo! thanx
Awesome! Thanks!
Top ! Thanks
You can send any message from any user with the token not sure if that's a risk.
There's no way to really get around that, it's limited to sending messages and to the channel.
Is this approach vulnerable to command injection? If an attacker is capable of controlling the filename they could attempt to write to: "&& malicious_command && exit", which should also prevent the Slack notification from coming through.
You should try it out. I did try it briefly and it didn't work but I didn't spend a lot of time on it.
Can you Please upload the script for the slack webhook and a export from the task scheduler to GitHub?
Id love to not have to retype the whole thing ;-}
If YMS was a hacker, you'd have Ippsec