Title:Sysmon Configuration Update Status:test Description:Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely References: -https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon Author: Nasreddine Bencherchali (Nextron Systems) Date: 2023-03-09 modified:2026-06-29 Tags:
-'attack.defense-impairment'
-'attack.t1685'
Logsource:
category: process_creation
product: windows
Detection: selection_pe: - Image|endswith: - '\Sysmon64.exe' - '\Sysmon64a.exe' - '\Sysmon.exe' Description:'System activity monitor'selection_cli: CommandLine|contains|windash:
'-c' condition:all of selection_* Falsepositives:
-Legitimate administrators might use this command to update Sysmon configuration. Level:medium
