Sysmon Configuration Error

Severity: high
Author: frack113
Source: upstream

Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1564` Hide Artifacts

Event coverage

Provider	Event ID	Title
Sysmon	255	Error report: UtcTime: UtcTime ID: ID Description: Description.

Stages and Predicates

Stage 1: `selection_error`

or:
Description|contains: 'Failed to connect to the driver to update configuration'
Description|contains: 'Failed to open service configuration with error'

Stage 2: `not 1 of filter*`

or:
Description|contains: 'Failed to open service configuration with error'
Description|contains: 'Last error: The media is write protected.'
Description|contains: 'Failed to open service configuration with error 19'
Description|contains: 'Failed to open service configuration with error 93'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Description`	match	`Failed to connect to the driver to update configuration` `Failed to open service configuration with error` `Failed to open service configuration with error 19` `Failed to open service configuration with error 93` `Last error: The media is write protected.`