Sysmon Channel Reference Deletion

Title: Sysmon Channel Reference Deletion
Status: test
Description:Potential threat actor tampering with Sysmon manifest and eventually disabling it
References:
  -https://twitter.com/Flangvik/status/1283054508084473861
  -https://twitter.com/SecurityJosh/status/1283027365770276866
  -https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html
  -https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-07-14
modified:2025-10-22
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• product: windows
• service: security

Detection:
  selection1:
    EventID: '4657'
    ObjectName|contains:
      -'WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'
      -'WINEVT\Channels\Microsoft-Windows-Sysmon/Operational'

    ObjectValueName: 'Enabled'
    NewValue: '0'
  selection2:
    EventID: '4663'
    ObjectName|contains:
      -'WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'
      -'WINEVT\Channels\Microsoft-Windows-Sysmon/Operational'

    AccessMask: '0x10000'
  condition:1 of selection*
Falsepositives:
  -Unknown
Level: high