Sysmon Configuration Update

Rule Info

Name
Sysmon Configuration Update
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely
Reference
https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
Date
2023-03-09 00:00:00
Modified
2024-03-13 00:00:00
Id
87911521-7098-470b-a459-9a57fc80bdfd
Tags
attack.defense-evasion attack.t1562.001
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=87911521-7098-470b-a459-9a57fc80bdfd

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
frack113
Merge PR #4767 from @frack113 - Update additional rules to use the `windash` modifier
2024-03-15
33bed27a7
Nasreddine Bencherchali
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18
95793d73b
Nasreddine Bencherchali
fix: apply suggestions from code review
2023-03-13
d7083f617
Nasreddine Bencherchali
fix: fp found in testing
2023-03-09
b36fb603e
Nasreddine Bencherchali
feat: update and fixes
2023-03-09
f23780de6
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022