title: Sysmon Configuration Error
author: frack113
date: 2021/06/04
description: Someone try to hide from Sysmon
detection:
  SELECTION_1:
    EventID: 255
  SELECTION_2:
    Description:
    - '*Failed to open service configuration with error*'
    - '*Failed to connect to the driver to update configuration*'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- legitimate administrative action
id: 815cd91b-7dbc-4247-841a-d7dd1392b0a8
level: high
logsource:
  category: sysmon_error
  product: windows
modified: 2021/11/12
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
- https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
status: experimental
tags:
- attack.defense_evasion
- attack.t1564
ruletype: SIGMA