From 643bd9f103a6dacda692ee880a9146f6676e6e2b Mon Sep 17 00:00:00 2001
From: huoji <root@key08.com>
Date: Wed, 21 Sep 2022 15:37:24 +0800
Subject: [PATCH] Update sysmon.xml

---
 sysmon.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sysmon.xml b/sysmon.xml
index 49185be..5668696 100644
--- a/sysmon.xml
+++ b/sysmon.xml
@@ -376,6 +376,11 @@
 
 	<RuleGroup name="" groupRelation="or">
 		<NetworkConnect onmatch="exclude">
+			<Image condition="end with">clash-win64.exe</Image>
+			<Image condition="end with">dasHost.exe</Image>
+			<Image condition="end with">DingTalk.exe</Image>
+			<Image condition="end with">vmnat.exe</Image>
+			
 			<!--SECTION: Microsoft-->
 			<Image condition="begin with">C:\ProgramData\Microsoft\Windows Defender\Platform\</Image>
 			<Image condition="is">C:\Windows\system32\svchost.exe</Image> <!--Microsoft: svchost-->