From 0647571f6caf8a4f64674ee3ed533480550c06bb Mon Sep 17 00:00:00 2001
From: Yasser <y.o.alhazmi@pm.me>
Date: Sat, 29 Jul 2023 21:04:35 +0300
Subject: [PATCH] disable blocking download of an executable

---
 sysmonconfig-research.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-research.xml b/sysmonconfig-research.xml
index 0338b46b..c16c0297 100644
--- a/sysmonconfig-research.xml
+++ b/sysmonconfig-research.xml
@@ -69,7 +69,7 @@
 	  <ClipboardChange onmatch="exclude"/>
 	  <ProcessTampering onmatch="exclude"/>
 	  <FileDeleteDetected onmatch="exclude"/>
-	  <FileBlockExecutable onmatch="exclude"/>
+	  <FileBlockExecutable onmatch="include"/>
 	  <FileBlockShredding onmatch="exclude"/>
   </EventFiltering>
 </Sysmon>