Sysmon Driver Altitude Change

Title: Sysmon Driver Altitude Change
Status: test
Description:Detects changes in Sysmon driver altitude value. If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.
References:
  -https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650
  -https://youtu.be/zSihR3lTf7g
Author: B.Talebi
Date: 2022-07-28
modified:2024-03-25
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: '\Services\'
    TargetObject|endswith: '\Instances\Sysmon Instance\Altitude'
  condition:selection
Falsepositives:
  -Legitimate driver altitude change to hide sysmon
Level: high