{"id":"4916a35e-bfc4-47d0-8e25-a003d7067061","title":"Sysmon Driver Altitude Change","description":"Detects changes in Sysmon driver altitude value.\nIf the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.\n","author":"B.Talebi","status":"test","level":"high","date":"2022-07-28","modified":"2024-03-25","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Legitimate driver altitude change to hide sysmon"],"references":["https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650","https://youtu.be/zSihR3lTf7g"],"source_path":"rules/windows/registry/registry_set/registry_set_change_sysmon_driver_altitude.yml","source_sha256":"3c0ae9cb61a50dc9825d0a51aeb2bb5a0819a836ba237489283ccbeabe91da41","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_change_sysmon_driver_altitude.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Sysmon Driver Altitude Change\nid: 4916a35e-bfc4-47d0-8e25-a003d7067061\nstatus: test\ndescription: |\n    Detects changes in Sysmon driver altitude value.\n    If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.\nreferences:\n    - https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650\n    - https://youtu.be/zSihR3lTf7g\nauthor: B.Talebi\ndate: 2022-07-28\nmodified: 2024-03-25\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains: '\\Services\\'\n        TargetObject|endswith: '\\Instances\\Sysmon Instance\\Altitude'\n    condition: selection\nfalsepositives:\n    - Legitimate driver altitude change to hide sysmon\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/4916a35e-bfc4-47d0-8e25-a003d7067061.json","kind":"sigma"}