Windows Sysmon integrity-attack tool execution (SysmonEnte) via Sysmon process access

title: Windows Sysmon integrity-attack tool execution (SysmonEnte) via Sysmon process access
id: 91551abe-70fa-459a-b05b-447376bff8ac
status: test
description: This rule detects process access attempts targeting Sysmon binaries (Sysmon.exe, Sysmon64.exe, Sysmon64a.exe) with a specific GrantedAccess value, and correlates the activity with a call trace containing "Ente". Such behavior matters because tools that impair Sysmon can undermine visibility and integrity of host telemetry, helping attackers evade detection. The detection relies on Windows process access telemetry that records TargetImage, GrantedAccess, and CallTrace fields.
references:
  - https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html
  - https://github.com/codewhitesec/SysmonEnte/
  - https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_sysmonente.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-07
modified: 2026-06-29
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: process_access
  product: windows
detection:
  selection_sysmon:
    TargetImage|contains:
      - :\Windows\Sysmon.exe
      - :\Windows\Sysmon64.exe
      - :\Windows\Sysmon64a.exe
    GrantedAccess: "0x1400"
  selection_calltrace:
    CallTrace: Ente
  filter_main_generic:
    SourceImage|contains:
      - :\Program Files (x86)\
      - :\Program Files\
      - :\Windows\System32\
      - :\Windows\SysWOW64\
  filter_main_msdefender:
    SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\Platform\
    SourceImage|endswith: \MsMpEng.exe
  condition: ( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d29ada0f-af45-4f27-8f32-f7b77c3dbc4e
    type: derived