Sysmon Channel Reference Deletion — Sigma Rule

Rule metadata and linked tags

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). Source status: test; severity: high. Source dates: 2020-07-14 / 2025-10-22.

{
  "product": "windows",
  "service": "security"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 6b6edf258a2f7db1dfc08dd6b180422e1df4f63345980443838f5cc10b4b5dab

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Sysmon Channel Reference Deletion
id: 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc
status: test
description: Potential threat actor tampering with Sysmon manifest and eventually disabling it
references:
    - https://twitter.com/Flangvik/status/1283054508084473861
    - https://twitter.com/SecurityJosh/status/1283027365770276866
    - https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html
    - https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-07-14
modified: 2025-10-22
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    product: windows
    service: security
detection:
    selection1:
        EventID: 4657
        ObjectName|contains:
            - 'WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'
            - 'WINEVT\Channels\Microsoft-Windows-Sysmon/Operational'
        ObjectValueName: 'Enabled'
        NewValue: 0
    selection2:
        EventID: 4663
        ObjectName|contains:
            - 'WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'
            - 'WINEVT\Channels\Microsoft-Windows-Sysmon/Operational'
        AccessMask: '0x10000'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: high

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://twitter.com/Flangvik/status/1283054508084473861
• https://twitter.com/SecurityJosh/status/1283027365770276866
• https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html
• https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8