Sysmon Configuration Update

Rule Info

Tags
attack.defense_evasion DEMO attack.t1562.001
Modified
None
Author
Nasreddine Bencherchali (Nextron Systems)
Name
Sysmon Configuration Update
Description
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely
Date
2023-03-09 00:00:00
Id
87911521-7098-470b-a459-9a57fc80bdfd
Type
Community Rule

Rule History

Commit
Date
Author
Title
2023-03-13
Nasreddine Bencherchali
fix: apply suggestions from code review
2023-03-09
Nasreddine Bencherchali
fix: fp found in testing
2023-03-09
Nasreddine Bencherchali
feat: update and fixes