Sigma high test sigma

HackTool - SysmonEnte Execution

Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon

View Source

Detection Logic

{
  "selection_sysmon": {
    "TargetImage
| contains": [
      ":\\Windows\\Sysmon.exe",
      ":\\Windows\\Sysmon64.exe",
      ":\\Windows\\Sysmon64a.exe"
    ],
    "GrantedAccess": "0x1400"
  },
  "selection_calltrace": {
    "CallTrace": "Ente"
  },
  "filter_main_generic": {
    "SourceImage
| contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\"
    ]
  },
  "filter_main_msdefender": {
    "SourceImage
| contains": ":\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
    "SourceImage
| endswith": "\\MsMpEng.exe"
  },
  "condition": "( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...