Rule Info
Tags
attack.defense_evasion DEMO attack.t1562.001
Modified
None
Author
Nasreddine Bencherchali (Nextron Systems)
Name
Sysmon Configuration Update
Description
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely
Date
2023-03-09 00:00:00
Id
87911521-7098-470b-a459-9a57fc80bdfd
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR