Windows Sysmon error events indicating service configuration update failures
Flags Windows Sysmon errors for failed service configuration/driver update attempts that may indicate tampering.
- Product
- windows
- Category
- sysmon_error
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-06-04
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Sysmon error messages reporting failures when opening service configuration and connecting to the driver to update configuration. Such activity can be used by an adversary attempting to disrupt or evade Sysmon logging, making these errors a useful stealth/defense evasion signal. The detection relies on the presence of specific error text and related error-code wording in Sysmon error telemetry, with several language and generic benign patterns filtered out.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- talesfrominfosec.blogspot.comhttps://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_config_modification_error.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Sysmon error events indicating service configuration update failures
id: ed60b24a-34f7-4ad3-ae6b-694bbfd0d48d
status: test
description: This rule matches Sysmon error messages reporting failures when opening service configuration and connecting to the driver to update configuration. Such activity can be used by an adversary attempting to disrupt or evade Sysmon logging, making these errors a useful stealth/defense evasion signal. The detection relies on the presence of specific error text and related error-code wording in Sysmon error telemetry, with several language and generic benign patterns filtered out.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_config_modification_error.yml
author: frack113, Huntrule Team
date: 2021-06-04
modified: 2026-07-23
tags:
- attack.stealth
- attack.t1564
logsource:
product: windows
category: sysmon_error
detection:
selection_error:
Description|contains:
- Failed to open service configuration with error
- Failed to connect to the driver to update configuration
filter_generic_english:
Description|contains|all:
- Failed to open service configuration with error
- "Last error: The media is write protected."
filter_generic_french:
Description|contains|all:
- Failed to open service configuration with error
- "Last error: Média protégé en écriture."
filter_by_errorcode:
Description|contains:
- Failed to open service configuration with error 19
- Failed to open service configuration with error 93
condition: selection_error and not 1 of filter*
falsepositives:
- Legitimate administrative action
level: high
license: DRL-1.1
related:
- id: 815cd91b-7dbc-4247-841a-d7dd1392b0a8
type: derived