Hayabusa high test sigma

Sysmon Configuration Modification

Detects when an attacker tries to hide from Sysmon by disabling or stopping it

View Source

Detection Logic

{
  "sysmon_status": {
    "EventID": [
      4,
      16
    ],
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_stop": {
    "State": "Stopped"
  },
  "selection_conf": [
    "Sysmon config state changed"
  ],
  "filter": {
    "State": "Started"
  },
  "condition": "sysmon_status and (1 of selection_* and not filter)"
}

False Positives

  • ⚠ Legitimate administrative action

Field Validations

Loading…

Comments (0)

Loading comments...