📜 Sysmon Config Builder

How to use it

1. Pick a schema version (it must be ≤ your Sysmon binary's; 4.90 = Sysmon v15+) and the hash algorithms to record.
2. Add a rule group per event type, choose include or exclude, add field conditions, and watch the XML build live.
3. Read the Validation panel — red items would make Sysmon reject the config; yellow items are valid but worth a second look.
4. Copy or download the XML, then on the host run sysmon -c sysmon-config.xml (or sysmon -i sysmon-config.xml for a fresh install). Test on one machine first.

Include vs exclude (read this before deploying)

• include — Sysmon logs an event only when a rule matches. An include group with no rules logs nothing for that event (a deliberate way to disable an event).
• exclude — Sysmon logs every event except those a rule matches. An exclude group with no rules logs everything of that type. Exclude matches always take precedence over include matches.
• groupRelation — or (default) logs when any condition matches; and requires all conditions in the group to match the same event.

Conditions

The condition operators offered are exactly Sysmon's: is, is any, is not, contains, contains any, contains all, excludes, excludes any, excludes all, begin with, end with, not begin with, not end with, less than, more than, image. The … any/… all operators take a ;-delimited list of values. image matches a process image by name or full path (e.g. lsass.exe matches C:\windows\system32\lsass.exe). Values are XML-escaped automatically, so &, <, >, " and ' in a path are safe.

Limitations

• This builds the common <RuleGroup> → event → field-condition structure. Nested <Rule> elements (mixing AND/OR inside one event filter) are not yet offered — use group-level groupRelation for AND/OR.
• It validates the schema's structure, event names, field names and condition operators, but it cannot know your Sysmon binary version — verify the schema version with sysmon -? config.
• It is a composition aid, not a tuned detection baseline. For production, start from a maintained community config and tune it.

References

• Microsoft Learn — Sysmon (Sysinternals) — event IDs, config entries, conditions, RuleGroup/groupRelation.
• SwiftOnSecurity/sysmon-config and olafhartong/sysmon-modular — maintained community baselines to adapt.