title: Sysmon Channel Reference Deletion
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020/07/14
description: Potential threat actor tampering with Sysmon manifest and eventually
  disabling it
detection:
  SELECTION_1:
    ObjectName:
    - '*WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}*'
    - '*WINEVT\Channels\Microsoft-Windows-Sysmon/Operational*'
  SELECTION_2:
    EventID: 4657
  SELECTION_3:
    ObjectValueName: Enabled
  SELECTION_4:
    NewValue: '0'
  SELECTION_5:
    EventID: 4663
  SELECTION_6:
    AccessMask: 65536
  condition: (SELECTION_1 and ((SELECTION_2 and SELECTION_3 and SELECTION_4) or (SELECTION_5
    and SELECTION_6)))
falsepositives:
- unknown
id: 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc
level: critical
logsource:
  product: windows
  service: security
references:
- https://twitter.com/Flangvik/status/1283054508084473861
- https://twitter.com/SecurityJosh/status/1283027365770276866
- https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html
- https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8
status: experimental
tags:
- attack.defense_evasion
- attack.t1112
ruletype: SIGMA