Rule Info
Name
Sysmon Configuration Update
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely
Date
2023-03-09 00:00:00
Modified
2024-03-13 00:00:00
Id
87911521-7098-470b-a459-9a57fc80bdfd
Tags
attack.defense_evasion attack.t1562.001 DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
frack113
Merge PR #4767 from @frack113 - Update additional rules to use the `windash` modifier
2024-03-15
Nasreddine Bencherchali
Merge PR #4482 From @nasbench - Add New Automation Workflows
2023-10-18
Scan your endpoints, forensic images or collected files with our portable scanner THOR