Sysmon RegistryEvent exclude not overriding include rule for Event ID 13
Hi all, I’m troubleshooting a Sysmon RegistryEvent exclusion issue. I have a Sysmon config with RegistryEvent includes for COM hijacking detection, including: \InprocServer32\(Default) This correctly logs the following E
📄
This source provides headlines only. Use the button below to read the complete article on the original site.
📰 Read the original article on r/cybersecurity
Originally published by r/cybersecurity. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.