Windows Security Event Alerts on Sysmon Channel Reference Deletion

title: Windows Security Event Alerts on Sysmon Channel Reference Deletion
id: 51d5b0b5-b47f-443c-a55d-8373efa25fb6
status: test
description: This rule flags Windows event log permission or registry changes that remove the Sysmon Operational channel being set to Disabled (Event ID 4657 with Enabled set to 0) and the associated access changes (Event ID 4663). Attackers may tamper with Sysmon configuration to reduce visibility and hinder incident response. It relies on Windows Security telemetry capturing changes to WINEVT channel objects, including the specific ObjectValueName transition and AccessMask indicating a write/permission-related operation.
references:
  - https://twitter.com/Flangvik/status/1283054508084473861
  - https://twitter.com/SecurityJosh/status/1283027365770276866
  - https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html
  - https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_sysmon_channel_reference_deletion.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-07-14
modified: 2025-10-22
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  product: windows
  service: security
detection:
  selection1:
    EventID: 4657
    ObjectName|contains:
      - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}
      - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational
    ObjectValueName: Enabled
    NewValue: 0
  selection2:
    EventID: 4663
    ObjectName|contains:
      - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}
      - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational
    AccessMask: "0x10000"
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc
    type: derived