Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy

Read More

Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy.

Read More

Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration

Read More

Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages

Read More

Detects when an attacker tries to hide from Sysmon by disabling or stopping it

Read More

Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is created.

Read More