huntrule

Windows Sysmon error events indicating service configuration update failures

Flags Windows Sysmon errors for failed service configuration/driver update attempts that may indicate tampering.

FreeUnreviewedSigmahighv1
title: Windows Sysmon error events indicating service configuration update failures
id: ed60b24a-34f7-4ad3-ae6b-694bbfd0d48d
status: test
description: This rule matches Sysmon error messages reporting failures when opening service configuration and connecting to the driver to update configuration. Such activity can be used by an adversary attempting to disrupt or evade Sysmon logging, making these errors a useful stealth/defense evasion signal. The detection relies on the presence of specific error text and related error-code wording in Sysmon error telemetry, with several language and generic benign patterns filtered out.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_config_modification_error.yml
author: frack113, Huntrule Team
date: 2021-06-04
modified: 2026-07-23
tags:
  - attack.stealth
  - attack.t1564
logsource:
  product: windows
  category: sysmon_error
detection:
  selection_error:
    Description|contains:
      - Failed to open service configuration with error
      - Failed to connect to the driver to update configuration
  filter_generic_english:
    Description|contains|all:
      - Failed to open service configuration with error
      - "Last error: The media is write protected."
  filter_generic_french:
    Description|contains|all:
      - Failed to open service configuration with error
      - "Last error: Média protégé en écriture."
  filter_by_errorcode:
    Description|contains:
      - Failed to open service configuration with error 19
      - Failed to open service configuration with error 93
  condition: selection_error and not 1 of filter*
falsepositives:
  - Legitimate administrative action
level: high
license: DRL-1.1
related:
  - id: 815cd91b-7dbc-4247-841a-d7dd1392b0a8
    type: derived

What it detects

This rule matches Sysmon error messages reporting failures when opening service configuration and connecting to the driver to update configuration. Such activity can be used by an adversary attempting to disrupt or evade Sysmon logging, making these errors a useful stealth/defense evasion signal. The detection relies on the presence of specific error text and related error-code wording in Sysmon error telemetry, with several language and generic benign patterns filtered out.

Known false positives

  • Legitimate administrative action

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.