sysmon

Apr 28, 2026 · attack.defense-impairment ·

Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy

Apr 28, 2026 · attack.defense-impairment ·

Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy.

Apr 28, 2026 · attack.defense-impairment ·

Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration

Apr 28, 2026 · attack.stealth attack.t1564 ·

Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages

Apr 28, 2026 · attack.stealth attack.t1564 ·

Detects when an attacker tries to hide from Sysmon by disabling or stopping it

Apr 28, 2026 · attack.defense-impairment ·

Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is created.