Windows Sysmon Configuration Event Where Sysmon Stops

title: Windows Sysmon Configuration Event Where Sysmon Stops
id: f83df817-4589-4772-9bac-8e25df4244e6
status: test
description: This rule flags Sysmon-related status events indicating the Sysmon service has a state of Stopped while a Sysmon configuration state change message is present. Attackers may try to evade monitoring by disabling or halting Sysmon, reducing visibility into subsequent activity. Detection relies on Windows Sysmon status telemetry fields capturing the service state and the associated configuration state change event text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_config_modification_status.yml
author: frack113, Huntrule Team
date: 2021-06-04
modified: 2022-08-02
tags:
  - attack.stealth
  - attack.t1564
logsource:
  product: windows
  category: sysmon_status
detection:
  selection_stop:
    State: Stopped
  selection_conf:
    - Sysmon config state changed
  filter:
    State: Started
  condition: 1 of selection_* and not filter
falsepositives:
  - Legitimate administrative action
level: high
license: DRL-1.1
related:
  - id: 1f2b5353-573f-4880-8e33-7d04dcf97744
    type: derived