Windows Sysmon Configuration Change (Event ID 16)

Alerts on Sysmon configuration changes via Sysmon Event ID 16 on Windows.

FreeUnreviewedSigmamediumv1

windows-sysmon-configuration-change-event-id-16-8ac03a65

title: Windows Sysmon Configuration Change (Event ID 16)
id: c2d7186c-e39d-4b83-9ea1-d77cb6d486cd
status: test
description: This rule flags Sysmon events indicating a configuration change (Sysmon Event ID 16) on Windows. Attackers may alter Sysmon settings to blind or reduce visibility, or to evade monitoring after gaining access. The detection relies on Sysmon’s own event logging for configuration update activities.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_config_modification.yml
author: frack113, Huntrule Team
date: 2022-01-12
tags:
  - attack.defense-impairment
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 16
  condition: selection
falsepositives:
  - Legitimate administrative action
level: medium
regression_tests_path: regression_data/rules/windows/sysmon/sysmon_config_modification/info.yml
license: DRL-1.1
related:
  - id: 8ac03a65-6c84-4116-acad-dc1558ff7a77
    type: derived

What it detects

This rule flags Sysmon events indicating a configuration change (Sysmon Event ID 16) on Windows. Attackers may alter Sysmon settings to blind or reduce visibility, or to evade monitoring after gaining access. The detection relies on Sysmon’s own event logging for configuration update activities.

Known false positives

Legitimate administrative action

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.