HackTool - SysmonEnte Execution

calendar Jul 1, 2026 · attack.defense-impairment attack.t1685.001  ·
Share on: linkedin copy

Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon

Sigma rule (View on GitHub)

 1title: HackTool - SysmonEnte Execution
 2id: d29ada0f-af45-4f27-8f32-f7b77c3dbc4e
 3status: test
 4description: Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon
 5references:
 6    - https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html
 7    - https://github.com/codewhitesec/SysmonEnte/
 8    - https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png
 9author: Florian Roth (Nextron Systems)
10date: 2022-09-07
11modified: 2026-06-29
12tags:
13    - attack.defense-impairment
14    - attack.t1685.001
15logsource:
16    category: process_access
17    product: windows
18detection:
19    selection_sysmon:
20        TargetImage|contains:
21            - ':\Windows\Sysmon.exe'
22            - ':\Windows\Sysmon64.exe'
23            - ':\Windows\Sysmon64a.exe'
24        GrantedAccess: '0x1400'
25    selection_calltrace:
26        CallTrace: 'Ente'
27    filter_main_generic:
28        SourceImage|contains:
29            - ':\Program Files (x86)\'
30            - ':\Program Files\'
31            - ':\Windows\System32\'
32            - ':\Windows\SysWOW64\'
33    filter_main_msdefender:
34        SourceImage|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
35        SourceImage|endswith: '\MsMpEng.exe'
36    condition: ( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace
37falsepositives:
38    - Unknown
39level: high

References

Related rules

to-top