Post

I wanted a script I could run on a new Windows box that would install sysmon with @olafhartong.nl's configs, and set logging best practices with Zach Mathis' (Yamato Security) "EnableWindowsLogSettings" configs. So I made one! Feel free to inspect it and repurpose. gist.github.com/ecapuano/42f...

gist.github.comA PowerShell script for installing Sysmon and enabling best-practice audit logs.A PowerShell script for installing Sysmon and enabling best-practice audit logs. - better_event_logging.ps1

1/3/25, 8:12 pm19 reposts72 likes

J, aquele lá

@johnnyc.bsky.social

1 Mar 2025

I wonder how many monitoring signatures this will trigger😏

J, aquele lá

@johnnyc.bsky.social

1 Mar 2025

BTW, hey Eric! Nice finding you here! =D

Eric Capuano

@eric.zip

1 Mar 2025

BTW this was intended for personal systems and VMs… there are much better ways to do this across an enterprise.

Simon simonsen

@sim0ns3n.bsky.social

3 Mar 2025

Please share them too 😀

Eric Capuano

@eric.zip

3 Mar 2025

That’s a whole other discussion and very dependent on tools available to the org. We’ve used velociraptor for this in the past, but GPO, SCCM, and other options exist. youtu.be/cA3KGmOxVU8?...