Sysmon Configuration Modification — Sigma Rule

Rule metadata and linked tags

Author: frack113. Source status: test; severity: high. Source dates: 2021-06-04 / 2022-08-02.

{
  "product": "windows",
  "category": "sysmon_status"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 72e138e08f33f29c92acc2b0fce7b75403746152f459ad36767d858155d416c4

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Sysmon Configuration Modification
id: 1f2b5353-573f-4880-8e33-7d04dcf97744
status: test
description: Detects when an attacker tries to hide from Sysmon by disabling or stopping it
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
    - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
author: frack113
date: 2021-06-04
modified: 2022-08-02
tags:
    - attack.stealth
    - attack.t1564
logsource:
    product: windows
    category: sysmon_status
detection:
    selection_stop:
        State: Stopped
    selection_conf:
        - 'Sysmon config state changed'
    filter:
        State: Started
    condition: 1 of selection_* and not filter
falsepositives:
    - Legitimate administrative action
level: high

Original YAML and metadata in JSON

False positives

• Legitimate administrative action

Source references

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
• https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html