From 2ac1b425c78b1348593088d64b815b00eabb56e9 Mon Sep 17 00:00:00 2001
From: Fplyth0ner <fplyth0ner@qq.com>
Date: Sun, 11 Sep 2022 00:07:39 +0800
Subject: [PATCH] Update sysmon.xml

Add Microsoft Outlook Tamplate Macro file creation event.
---
 sysmon.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmon.xml b/sysmon.xml
index c5f2b75..5021b38 100644
--- a/sysmon.xml
+++ b/sysmon.xml
@@ -583,6 +583,7 @@
 			<TargetFilename name="T1176" condition="end with">.crx</TargetFilename> <!--Chrome extension-->
 			<TargetFilename condition="end with">.dmp</TargetFilename> <!--Process dumps [ (fr) http://blog.gentilkiwi.com/securite/mimikatz/minidump ] -->
 			<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: Macro-->
+			<TargetFilename condition="end with">.otm</TargetFilename> <!--Microsoft:Office:VBS: Macro-->
 			<TargetFilename name="DLL" condition="end with">.dll</TargetFilename> <!--Microsoft:Office:Word: Macro-->
 			<TargetFilename name="EXE" condition="end with">.exe</TargetFilename> <!--Executable-->
 			<TargetFilename name="ProcessHostingdotNETCode" condition="end with">.exe.log</TargetFilename> <!-- [ https://github.com/bitsadmin/nopowershell ] | Credit: @SBousseaden [ https://twitter.com/SBousseaden/status/1137493597769687040 ]  -->