服务器 Gind.cn

服务器问题集锦,包括 Linux(Ubuntu, Centos,Debian等)和Windows Server服务器

Windows事件查看器AppLocker XPathfilter

我正在运行AppLocker,并希望使用XPath在事件查看器中logging事件中的一些噪音。 具体来说,我想隐藏任何与CMD.exe相关的事件 这是一个我想摆脱的示例条目: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-AppLocker" Guid="{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}" /> <EventID>8003</EventID> <Version>0</Version> <Level>3</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x8000000000000000</Keywords> <TimeCreated SystemTime="2014-05-29T05:47:09.625405200Z" /> <EventRecordID>257765</EventRecordID> <Correlation /> <Execution ProcessID="1108" ThreadID="2652" /> <Channel>Microsoft-Windows-AppLocker/EXE and DLL</Channel> <Computer>COMPUTERNAME.DOMAIN</Computer> <Security UserID="S-1-5-21-123456789-123456789-123456789-123456" /> </System> <UserData> <RuleAndFileData xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0"> <PolicyName>EXE</PolicyName> <RuleId>{00000000-0000-0000-0000-000000000000}</RuleId> <RuleName>-</RuleName> <RuleSddl>-</RuleSddl> <TargetUser>S-1-5-21-123456789-123456789-123456789-123456</TargetUser> <TargetProcessId>3224</TargetProcessId> <FilePath>%SYSTEM32%\CMD.EXE</FilePath> <FileHash>5F98965FF2650B89586176B38F007CA13A9E525E877DDCCBCDCE0A90408672D5</FileHash> <Fqbn>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT® WINDOWS® OPERATING SYSTEM\CMD.EXE\6.1.7601.17514</Fqbn> </RuleAndFileData> […]