Detectionmediumtest
Sysmon Configuration Update
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Thu Mar 09Updated Wed Mar 1387911521-7098-470b-a459-9a57fc80bdfdwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection_pe:
- Image|endswith:
- \Sysmon64.exe
- \Sysmon.exe
- Description: 'System activity monitor'
selection_cli:
CommandLine|contains|windash: '-c'
condition: all of selection_*False Positives
Legitimate administrators might use this command to update Sysmon configuration.
References
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
87911521-7098-470b-a459-9a57fc80bdfd
Status
test
Level
medium
Type
Detection
Created
Thu Mar 09
Modified
Wed Mar 13
Path
rules/windows/process_creation/proc_creation_win_sysinternals_sysmon_config_update.yml
Raw Tags
attack.defense-evasionattack.t1562.001