huntrule

Windows Sysmon Configuration Event Where Sysmon Stops

Alert on Sysmon status showing a stop event concurrent with a Sysmon configuration state change.

FreeReviewedSigma · High · v1
Product
windows
Category
sysmon_status
Author
frack113 (SigmaHQ), DRL 1.1
Published
2021-06-04
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Sysmon-related status events indicating the Sysmon service has a state of Stopped while a Sysmon configuration state change message is present. Attackers may try to evade monitoring by disabling or halting Sysmon, reducing visibility into subsequent activity. Detection relies on Windows Sysmon status telemetry fields capturing the service state and the associated configuration state change event text.

Reporting behind it

Related detections9 linkedT1564 — drag to rearrange
Suspicious Windows Security Spoofing via pin Executable Writing output.txt via process_creation
Obfuscated Extended Rights Backdoor Obfuscation - Via localizationDisplayId Attribute (via security)
Suspicious Process Execution from Public User Media Folders via process_creation
Suspicious Windows Sandbox Configuration Execution for AsyncRAT via Process Creation
System Informer Execution on Windows Process Creation
Linux mount executed with hidepid=2 option
Windows Process Hacker Execution Identified by Image Metadata and Hashes
Windows File Events: Suspicious Executable File Name Creation
Windows: Suspicious Parent Process Execution From \Users\Public Spawning Scripting/Shell Binaries
Windows Sysmon Configuration Event Where Sysmon Stops
Pivot detection · T1564 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.