Sagan high stable other

[WINDOWS-SYSMON] Attack on Sysmon - Possible Driver Unload

[WINDOWS-SYSMON] Attack on Sysmon - Possible Driver Unload

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Attack on Sysmon - Possible Driver Unload"; program:*Sysmon*; event_id:255; content:"ID: DriverCommunication"; nocase; content:"The I/O operation has been aborted"; nocase; reference:url,codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html; reference:url,github.com/matterpreter/Shhmon; reference:url,posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650; classtype:suspicious-command; sid:5007696; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...