Sysmon Driver Altitude Change — Sigma Rule

Rule metadata and linked tags

Author: B.Talebi. Source status: test; severity: high. Source dates: 2022-07-28 / 2024-03-25.

{
  "category": "registry_set",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 3c0ae9cb61a50dc9825d0a51aeb2bb5a0819a836ba237489283ccbeabe91da41

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Sysmon Driver Altitude Change
id: 4916a35e-bfc4-47d0-8e25-a003d7067061
status: test
description: |
    Detects changes in Sysmon driver altitude value.
    If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.
references:
    - https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650
    - https://youtu.be/zSihR3lTf7g
author: B.Talebi
date: 2022-07-28
modified: 2024-03-25
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Services\'
        TargetObject|endswith: '\Instances\Sysmon Instance\Altitude'
    condition: selection
falsepositives:
    - Legitimate driver altitude change to hide sysmon
level: high

Original YAML and metadata in JSON

False positives

• Legitimate driver altitude change to hide sysmon

Source references

• https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650
• https://youtu.be/zSihR3lTf7g