Detection rules › Sigma
Sysmon Configuration Error
Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
Known false positives
- Legitimate administrative action
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 255: Error report: UtcTime: UtcTime ID: ID Description: Description. |
Rule body
title: Sysmon Configuration Error
id: 815cd91b-7dbc-4247-841a-d7dd1392b0a8
status: test
description: Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
author: frack113
date: 2021-06-04
modified: 2026-07-23
tags:
- attack.stealth
- attack.t1564
logsource:
product: windows
category: sysmon_error
detection:
selection_error:
Description|contains:
- 'Failed to open service configuration with error'
- 'Failed to connect to the driver to update configuration'
filter_generic_english:
Description|contains|all:
- 'Failed to open service configuration with error'
- 'Last error: The media is write protected.'
filter_generic_french:
Description|contains|all:
- 'Failed to open service configuration with error'
- 'Last error: Média protégé en écriture.'
filter_by_errorcode:
Description|contains:
- 'Failed to open service configuration with error 19'
- 'Failed to open service configuration with error 93'
condition: selection_error and not 1 of filter*
falsepositives:
- Legitimate administrative action
level: high
Stages and Predicates
Stage 0: condition
selection_error and not 1 of filter*Stage 1: selection_error
selection_error:
Description|contains:
- 'Failed to open service configuration with error'
- 'Failed to connect to the driver to update configuration'
Stage 2: not filter*
filter_generic_english:
Description|contains|all:
- 'Failed to open service configuration with error'
- 'Last error: The media is write protected.'
filter_generic_french:
Description|contains|all:
- 'Failed to open service configuration with error'
- 'Last error: Média protégé en écriture.'
filter_by_errorcode:
Description|contains:
- 'Failed to open service configuration with error 19'
- 'Failed to open service configuration with error 93'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Description | match | Failed to open service configuration with error | excludes:Description field:"Description" value:"Failed to open service configuration with error" |
Description | match | Last error: Média protégé en écriture. | excludes:Description field:"Description" value:"Last error: Média protégé en écriture." |
Description | match | Last error: The media is write protected. | excludes:Description field:"Description" value:"Last error: The media is write protected." |
Description | match | Failed to open service configuration with error 19 | excludes:Description field:"Description" value:"Failed to open service configuration with error 19" |
Description | match | Failed to open service configuration with error 93 | excludes:Description field:"Description" value:"Failed to open service configuration with error 93" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Description | match |
| field:"Description" kind:match |