Windows SysmonEnte Process Access Attempt (Sysmon.exe/ Sysmon64.exe/ Sysmon64a.exe)
Flags attempts to access Sysmon binaries consistent with SysmonEnte execution based on TargetImage, GrantedAccess, and CallTrace.
- Product
- windows
- Category
- process_access
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-07
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process access attempts against Sysmon executables by matching granted access value alongside target image paths for Sysmon.exe, Sysmon64.exe, and Sysmon64a.exe. It further correlates the activity using a call trace indicator containing 'Ente', while excluding certain common software sources to reduce noise. The behavior matters because tampering with Sysmon can undermine monitoring integrity. It relies on Windows process access telemetry that includes TargetImage, SourceImage, GrantedAccess, and CallTrace.
Reporting behind it
- codewhitesec.blogspot.comhttps://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html
- github.comhttps://github.com/codewhitesec/SysmonEnte/
- github.comhttps://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_sysmonente.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows SysmonEnte Process Access Attempt (Sysmon.exe/ Sysmon64.exe/ Sysmon64a.exe)
id: 91551abe-70fa-459a-b05b-447376bff8ac
status: test
description: This rule flags process access attempts against Sysmon executables by matching granted access value alongside target image paths for Sysmon.exe, Sysmon64.exe, and Sysmon64a.exe. It further correlates the activity using a call trace indicator containing 'Ente', while excluding certain common software sources to reduce noise. The behavior matters because tampering with Sysmon can undermine monitoring integrity. It relies on Windows process access telemetry that includes TargetImage, SourceImage, GrantedAccess, and CallTrace.
references:
- https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html
- https://github.com/codewhitesec/SysmonEnte/
- https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_sysmonente.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-07
modified: 2026-06-29
tags:
- attack.defense-impairment
- attack.t1685.001
logsource:
category: process_access
product: windows
detection:
selection_sysmon:
TargetImage|contains:
- :\Windows\Sysmon.exe
- :\Windows\Sysmon64.exe
- :\Windows\Sysmon64a.exe
GrantedAccess: "0x1400"
selection_calltrace:
CallTrace: Ente
filter_main_generic:
SourceImage|contains:
- :\Program Files (x86)\
- :\Program Files\
- :\Windows\System32\
- :\Windows\SysWOW64\
filter_main_msdefender:
SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\Platform\
SourceImage|endswith: \MsMpEng.exe
condition: ( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: d29ada0f-af45-4f27-8f32-f7b77c3dbc4e
type: derived