Sysmon Driver Altitude Change

calendar Mar 26, 2024 · attack.defense_evasion attack.t1562.001  ·
Share on: linkedin copy

Detects changes in Sysmon driver altitude value. If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.

Sigma rule (View on GitHub)

 1title: Sysmon Driver Altitude Change
 2id: 4916a35e-bfc4-47d0-8e25-a003d7067061
 3status: experimental
 4description: |
 5    Detects changes in Sysmon driver altitude value.
 6    If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.    
 7references:
 8    - https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650
 9    - https://youtu.be/zSihR3lTf7g
10author: B.Talebi
11date: 2022/07/28
12modified: 2024/03/25
13tags:
14    - attack.defense_evasion
15    - attack.t1562.001
16logsource:
17    category: registry_set
18    product: windows
19detection:
20    selection:
21        TargetObject|contains: '\Services\'
22        TargetObject|endswith: '\Instances\Sysmon Instance\Altitude'
23    condition: selection
24falsepositives:
25    - Legitimate driver altitude change to hide sysmon
26level: high

References

Related rules

to-top