From 5cd2c60668c7827733a6fa24250690fead7b371c Mon Sep 17 00:00:00 2001
From: Olaf Hartong <8149899+olafhartong@users.noreply.github.com>
Date: Wed, 20 Sep 2023 07:31:32 +0000
Subject: [PATCH] severe base noise reduction

---
 10_process_access/exclude_azure_monitor.xml   | 14 +++++++++++
 .../exclude_defender_for_endpoint copy.xml    | 10 ++++++++
 7_image_load/exclude_very_verbose.xml         | 25 +++++++++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100644 10_process_access/exclude_azure_monitor.xml
 create mode 100644 10_process_access/exclude_defender_for_endpoint copy.xml
 create mode 100644 7_image_load/exclude_very_verbose.xml

diff --git a/10_process_access/exclude_azure_monitor.xml b/10_process_access/exclude_azure_monitor.xml
new file mode 100644
index 00000000..cc91f247
--- /dev/null
+++ b/10_process_access/exclude_azure_monitor.xml
@@ -0,0 +1,14 @@
+<Sysmon schemaversion="4.30">
+   <EventFiltering>
+      <RuleGroup name="" groupRelation="or">
+         <ProcessAccess onmatch="exclude">
+            <Rule groupRelation="and">
+               <SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</SourceImage>
+               <TargetImage condition="is">C:\Windows\system32\cscript.exe</TargetImage>
+            </Rule>
+            <SourceImage condition="contains all">C:\WindowsAzure\GuestAgent_;CollectGuestLogs.exe</SourceImage>
+            <SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</SourceImage>
+         </ProcessAccess>
+      </RuleGroup>
+   </EventFiltering>
+</Sysmon>
diff --git a/10_process_access/exclude_defender_for_endpoint copy.xml b/10_process_access/exclude_defender_for_endpoint copy.xml
new file mode 100644
index 00000000..3ee61af5
--- /dev/null
+++ b/10_process_access/exclude_defender_for_endpoint copy.xml	
@@ -0,0 +1,10 @@
+<Sysmon schemaversion="4.30">
+   <EventFiltering>
+      <RuleGroup name="" groupRelation="or">
+         <ProcessAccess onmatch="exclude">
+            <SourceImage condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</SourceImage>
+            <SourceImage condition="contains all">C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\;\OpenHandleCollector.exe</SourceImage>
+         </ProcessAccess>
+      </RuleGroup>
+   </EventFiltering>
+</Sysmon>
diff --git a/7_image_load/exclude_very_verbose.xml b/7_image_load/exclude_very_verbose.xml
new file mode 100644
index 00000000..b949ac8b
--- /dev/null
+++ b/7_image_load/exclude_very_verbose.xml
@@ -0,0 +1,25 @@
+ <!--COMMENT:	Filtering these commonly loaded DLLs, which are so verbose they incur a lot of cost and have limited to no detection value-->
+<Sysmon schemaversion="4.30">
+  <EventFiltering>
+    <RuleGroup name="" groupRelation="or">
+      <ImageLoad onmatch="exclude">
+        <Rule groupRelation="and">
+          <Image condition="is">C:\Windows\System32\svchost.exe</Image>
+          <ImageLoaded condition="is">C:\Windows\System32\netapi32.dll</ImageLoaded>
+        </Rule>
+        <Rule groupRelation="and">
+          <Image condition="is">C:\Windows\System32\svchost.exe</Image>
+          <ImageLoaded condition="is">C:\Windows\System32\msvcp110_win.dll</ImageLoaded>
+        </Rule>
+        <Rule groupRelation="and">
+          <Image condition="is">C:\Windows\System32\svchost.exe</Image>
+          <ImageLoaded condition="is">C:\Windows\System32\dsreg.dll</ImageLoaded>
+        </Rule>
+        <Rule groupRelation="and">
+          <Image condition="is">C:\Windows\System32\svchost.exe</Image>
+          <ImageLoaded condition="is">C:\Windows\System32\perfctrs.dll</ImageLoaded>
+        </Rule>
+      </ImageLoad>
+    </RuleGroup>
+  </EventFiltering>
+</Sysmon>
\ No newline at end of file