1200kmSECURITY RESEARCH

1200KM / sigma-rule

Sysmon Driver Altitude Change — Sigma Rule

Sigma rule 4916a35e-bfc4-47d0-8e25-a003d7067061. Sysmon Driver Altitude Change — Sigma Rule. Detects changes in Sysmon driver altitude value. If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.

Rule metadata and linked tags

testhighregistry_setwindowsattack.defense-impairmentattack.t1685

Author: B.Talebi. Source status: test; severity: high. Source dates: 2022-07-28 / 2024-03-25.

Original logsource
{
  "category": "registry_set",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 3c0ae9cb61a50dc9825d0a51aeb2bb5a0819a836ba237489283ccbeabe91da41

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

Original Sigma rule YAML, scroll horizontally if needed
title: Sysmon Driver Altitude Change
id: 4916a35e-bfc4-47d0-8e25-a003d7067061
status: test
description: |
    Detects changes in Sysmon driver altitude value.
    If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.
references:
    - https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650
    - https://youtu.be/zSihR3lTf7g
author: B.Talebi
date: 2022-07-28
modified: 2024-03-25
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Services\'
        TargetObject|endswith: '\Instances\Sysmon Instance\Altitude'
    condition: selection
falsepositives:
    - Legitimate driver altitude change to hide sysmon
level: high

Original YAML and metadata in JSON

False positives

  • Legitimate driver altitude change to hide sysmon

Source references

Connected ecosystem references

Exact source-tagged techniques

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.