XML Issue with sysmonconfig-excludes-only.xml

[jvossler]

Error:

PS C:\Tools\Sysinternals> sysmon64.exe -c .\sysmonconfig-excludes-only.xml

System Monitor v13.33 - System activity monitor
By Mark Russinovich and Thomas Garnier
Copyright (C) 2014-2022 Microsoft Corporation
Using libxml2. libxml2 is Copyright (C) 1998-2012 Daniel Veillard. All Rights Reserved.
Sysinternals - www.sysinternals.com

Loading configuration file with schema version 4.90
Sysmon schema version: 4.81
Element RuleGroup content does not follow the DTD, expecting (ProcessCreate | FileCreateTime | NetworkConnect | ProcessTerminate | DriverLoad | ImageLoad | CreateRemoteThread | RawAccessRead | ProcessAccess | FileCreate | RegistryEvent | FileCreateStreamHash | PipeEvent | WmiEvent | DnsQuery | FileDelete | ClipboardChange | ProcessTampering | FileDeleteDetected), got (FileBlockExecutable )
No declaration for element FileBlockExecutable
No declaration for attribute onmatch of element FileBlockExecutable
Element RuleGroup content does not follow the DTD, expecting (ProcessCreate | FileCreateTime | NetworkConnect | ProcessTerminate | DriverLoad | ImageLoad | CreateRemoteThread | RawAccessRead | ProcessAccess | FileCreate | RegistryEvent | FileCreateStreamHash | PipeEvent | WmiEvent | DnsQuery | FileDelete | ClipboardChange | ProcessTampering | FileDeleteDetected), got (FileBlockShredding )
No declaration for element FileBlockShredding
No declaration for attribute onmatch of element FileBlockShredding
Element RuleGroup content does not follow the DTD, expecting (ProcessCreate | FileCreateTime | NetworkConnect | ProcessTerminate | DriverLoad | ImageLoad | CreateRemoteThread | RawAccessRead | ProcessAccess | FileCreate | RegistryEvent | FileCreateStreamHash | PipeEvent | WmiEvent | DnsQuery | FileDelete | ClipboardChange | ProcessTampering | FileDeleteDetected)*, got (FileExecutableDetected )
No declaration for element FileExecutableDetected
No declaration for attribute onmatch of element FileExecutableDetected
LIBXML2 Error: Failed to validate the xml configuration: .\sysmonconfig-excludes-only.xml
Usage:
Install: Sysmon64.exe -i []
Update configuration: Sysmon64.exe -c []
Install event manifest: Sysmon64.exe -m
Print schema: Sysmon64.exe -s
Uninstall: Sysmon64.exe -u [force]
-c Update configuration of an installed Sysmon driver or dump the
current configuration if no other argument is provided. Optionally
take a configuration file.
-i Install service and driver. Optionally take a configuration file.
-m Install the event manifest (done on service install as well)).
-s Print configuration schema definition of the specified version.
Specify 'all' to dump all schema versions (default is latest)).
-u Uninstall service and driver. Adding force causes uninstall to proceed
even when some components are not installed.

The service logs events immediately and the driver installs as a boot-start driver to capture activity from early in
the boot that the service will write to the event log when it starts.

On Vista and higher, events are stored in "Applications and Services Logs/Microsoft/Windows/Sysmon/Operational". On
older systems, events are written to the System event log.

Use the '-? config' command for configuration file documentation. More examples are available on the Sysinternals
website.

Specify -accepteula to automatically accept the EULA on installation, otherwise you will be interactively prompted to
accept it.
sysmonconfig-excludes-only.zip

Neither install nor uninstall requires a reboot.

PS C:\Tools\Sysinternals>

xml config file attached