Windows Sysmon Configuration Change (Event ID 16)
Alerts on Sysmon configuration changes via Sysmon Event ID 16 on Windows.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Service
- sysmon
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-12
- Updated
- 2026-07-30
What it detects
This rule flags Sysmon events indicating a configuration change (Sysmon Event ID 16) on Windows. Attackers may alter Sysmon settings to blind or reduce visibility, or to evade monitoring after gaining access. The detection relies on Sysmon’s own event logging for configuration update activities.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-sysmon-configuration-change-event-id-16-8ac03a65
title: Windows Sysmon Configuration Change (Event ID 16)
id: c2d7186c-e39d-4b83-9ea1-d77cb6d486cd
status: test
description: This rule flags Sysmon events indicating a configuration change (Sysmon Event ID 16) on Windows. Attackers may alter Sysmon settings to blind or reduce visibility, or to evade monitoring after gaining access. The detection relies on Sysmon’s own event logging for configuration update activities.
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_config_modification.yml
author: frack113, Huntrule Team
date: 2022-01-12
tags:
- attack.defense-impairment
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 16
condition: selection
falsepositives:
- Legitimate administrative action
level: medium
regression_tests_path: regression_data/rules/windows/sysmon/sysmon_config_modification/info.yml
license: DRL-1.1
related:
- id: 8ac03a65-6c84-4116-acad-dc1558ff7a77
type: derived