From d55fd7a10897b6e5b16d32e0ae3140be447ba0c7 Mon Sep 17 00:00:00 2001
From: Maicon Santos <maicon@linuxmail.org>
Date: Tue, 8 Aug 2023 11:10:36 -0300
Subject: [PATCH] Update for Kaspersky Modules

---
 sysmonconfig.xml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sysmonconfig.xml b/sysmonconfig.xml
index e390a2aa..7abd4dc2 100644
--- a/sysmonconfig.xml
+++ b/sysmonconfig.xml
@@ -1,4 +1,4 @@
-<!--                       NOTICE : This is a balanced generated output of Sysmon-modular with medium verbosity                  -->
+<!--                       NOTICE : This is a balanced generated output of Sysmon-modular with medium verbosity                  -->
 <!--                        due to the balanced nature of this configuration there will be potential blind spots                 -->
 <!--                        for more information go to https://github.com/olafhartong/sysmon-modular/wiki                        -->
 <!--                                                                                                                             -->
@@ -686,6 +686,7 @@
     <RuleGroup groupRelation="or">
       <FileCreateTime onmatch="exclude">
         <Image condition="end with">AppData\Local\Google\Chrome\Application\chrome.exe</Image>
+        <Image condition="end with">Program Files (x86)\Kaspersky Lab\Kaspersky Security for Windows Server\kavfswp.exe</Image>
         <Image condition="end with">Root\VFS\ProgramFilesX86\Google\Chrome\Application\chrome.exe</Image>
         <TargetFilename condition="contains">\NVIDIA\NvBackend\ApplicationOntology\</TargetFilename>
         <Image condition="image">OneDrive.exe</Image>
@@ -1468,6 +1469,9 @@
           <TargetFilename condition="contains all">C:\Program Files\Elastic\Agent\data\;.ndjson</TargetFilename>
         </Rule>
         <Image condition="is">C:\Windows\system32\igfxCUIService.exe</Image>
+        <Image condition="is">C:\Program Files (x86)\Kaspersky Lab\NetworkAgent\klnagent.exe</Image>
+        <Image condition="is">C:\Program Files (x86)\Kaspersky Lab\Endpoint Agent\soyuz.exe</Image>
+        <Image condition="is">C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security for Windows Server\kavshell.exe</Image>
         <Image condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe</Image>
         <Image condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe</Image>
         <Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image>