Sysmon Channel Reference Deletion

Status: test
Severity: high
Log source: product windows, service security
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source: github.com/SigmaHQ/sigma

Potential threat actor tampering with Sysmon manifest and eventually disabling it

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4657: A registry value was modified.
Security-Auditing	Event ID 4663: An attempt was made to access an object.

Rule body

title: Sysmon Channel Reference Deletion
id: 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc
status: test
description: Potential threat actor tampering with Sysmon manifest and eventually disabling it
references:
    - https://twitter.com/Flangvik/status/1283054508084473861
    - https://twitter.com/SecurityJosh/status/1283027365770276866
    - https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html
    - https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-07-14
modified: 2025-10-22
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    product: windows
    service: security
detection:
    selection1:
        EventID: 4657
        ObjectName|contains:
            - 'WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'
            - 'WINEVT\Channels\Microsoft-Windows-Sysmon/Operational'
        ObjectValueName: 'Enabled'
        NewValue: 0
    selection2:
        EventID: 4663
        ObjectName|contains:
            - 'WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'
            - 'WINEVT\Channels\Microsoft-Windows-Sysmon/Operational'
        AccessMask: '0x10000'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection1`

selection1:
    EventID: 4657
    ObjectName|contains:
        - 'WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'
        - 'WINEVT\Channels\Microsoft-Windows-Sysmon/Operational'
    ObjectValueName: 'Enabled'
    NewValue: 0

Stage 2: `selection2`

selection2:
    EventID: 4663
    ObjectName|contains:
        - 'WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'
        - 'WINEVT\Channels\Microsoft-Windows-Sysmon/Operational'
    AccessMask: '0x10000'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AccessMask`	eq	`0x10000`	`field:"AccessMask" kind:eq value:"0x10000"`
`NewValue`	eq	`0` corpus 18 (elastic 15, sigma 3)	`field:"Details" kind:eq value:"0"`
`ObjectName`	match	`WINEVT\Channels\Microsoft-Windows-Sysmon/Operational` `WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}`	`field:"ObjectName" kind:match`
`ObjectValueName`	eq	`Enabled`	`field:"ObjectValueName" kind:eq value:"Enabled"`

Sysmon Channel Reference Deletion

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection1

Stage 2: selection2

Indicators

Stage 0: `condition`

Stage 1: `selection1`

Stage 2: `selection2`