[WINDOWS-SYSMON] Attack on Sysmon - Possible Driver Unload

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Attack on Sysmon - Possible Driver Unload"; program:*Sysmon*; json_map:"event_id",".EventID"; json_map:"message",".RenderedDescription"; event_id:255; content:"ID: DriverCommunication"; nocase; reference:url,codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html; reference:url,github.com/matterpreter/Shhmon; reference:url,posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650; classtype:suspicious-command; sid:5009798; metadata: created_on 2022_11_22, old_sid 5007696; rev:1;)