gnh1201/welsonjs
1
0
Fork 0
mirror of https://github.com/gnh1201/welsonjs.git synced 2025-05-13 13:11:03 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Updated File Event Monitor (markdown)

Namhyeon Go 2024-09-10 14:37:34 +09:00
parent f523ffd329
commit 84443ace00
1 changed files with 32 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
File-Event-Monitor.md

@ -37,9 +37,39 @@ Once all implementations and configurations are complete, you should see the fol
2024-09-10 오후 2:22:14: onNetworkConnected recevied. technique_id=T1571,technique_name=Non-Standard Port, 33248, C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, udp://fe80:0:0:0:faa7:67af:298e:fb1d:5353 2024-09-10 오후 2:22:14: onNetworkConnected recevied. technique_id=T1571,technique_name=Non-Standard Port, 33248, C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, udp://fe80:0:0:0:faa7:67af:298e:fb1d:5353
``` ```
### For System Administrators or Security Analysts ### For System Administrators or Security Analysts
#### MITRE ATT&CK (MITRE attack) #### MITRE ATT&CK (MITRE attack)
WelsonJS can be utilized in conjunction with MITRE ATT&CK. Please follow the steps below:
1. Download [Sysinternals Sysmon (microsoft.com)](https://learn.microsoft.com/ko-kr/sysinternals/downloads/sysmon).
2. Download and apply [the sysmon configuration](https://github.com/olafhartong/sysmon-modular) (The configuration installation will be performed along with the sysmon installation using the command below.)
```
sysmon.exe -accepteula -i sysmonconfig.xml
```
3. In the WelsonJS configuration file (`settings.ini`), set the `DISABLE_FILE_MONITOR` (in the `Service` section) value to false.
```ini
[Service]
DISABLE_FILE_MONITOR=false
```
4. Install the WelsonJS service
```
installService.bat
```
If you want to debug it, start the interactive service.
```
startInteractiveService.bat
```
5. Check the log in the `WelsonJS.Service.Log.txt` file. Typically, the log file can be found in one of the following directories:
* C:\Windows\SystemTemp
* C:\User\<USERNAME>\AppData\Local\Temp