Detection rules › Sigma

Sysmon Configuration Modification

Severity
high
Author
frack113
Source
upstream

Detects when an attacker tries to hide from Sysmon by disabling or stopping it

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1564 Hide Artifacts

Event coverage

ProviderEvent IDTitle
Sysmon4Sysmon service state changed
Sysmon16ServiceConfigurationChange

Stages and Predicates

Stage 1: 1 of selection_stop

State: Stopped

Stage 2: 1 of selection_conf

: 'Sysmon config state changed'

Stage 3: not filter

State: Started

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Stateeq
  • Started
  • Stopped