Sysmon Configuration Update
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely
Detection logic
selection_pe
- Image|endswith:
- \Sysmon64.exe
- \Sysmon64a.exe
- \Sysmon.exe
- Description: System activity monitorselection_cli
CommandLine|contains|windash: -cCondition
all of selection_*Raw YAML
title: Sysmon Configuration Update
id: 87911521-7098-470b-a459-9a57fc80bdfd
status: test
description: Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-09
modified: 2026-06-29
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: process_creation
product: windows
detection:
selection_pe:
- Image|endswith:
- \Sysmon64.exe
- \Sysmon64a.exe
- \Sysmon.exe
- Description: 'System activity monitor'
selection_cli:
CommandLine|contains|windash: '-c'
condition: all of selection_*
falsepositives:
- Legitimate administrators might use this command to update Sysmon configuration.
level: mediumFalse positives
- Legitimate administrators might use this command to update Sysmon configuration.