Sysmon Configuration Error

{
  "selection_error": {
    "Description
| contains": [
      "Failed to open service configuration with error",
      "Failed to connect to the driver to update configuration"
    ]
  },
  "filter_generic_english": {
    "Description
| contains
| all": [
      "Failed to open service configuration with error",
      "Last error: The media is write protected."
    ]
  },
  "filter_generic_french": {
    "Description
| contains
| all": [
      "Failed to open service configuration with error",
      "Last error: Média protégé en écriture."
    ]
  },
  "filter_by_errorcode": {
    "Description
| contains": [
      "Failed to open service configuration with error 19",
      "Failed to open service configuration with error 93"
    ]
  },
  "condition": "selection_error and not 1 of filter*"
}

False Positives

• ⚠ Legitimate administrative action