Sysmon Channel Reference Deletion or Disablement
This rule detects attempts to tamper with Sysmon's operational settings by monitoring changes to specific registry keys related to Sysmon's event publishers and channels. Specifically, it looks for modifications that disable Sysmon's 'Enabled' status (EventID 4657, NewValue 0) or attempts to delete the Sysmon operational channel (EventID 4663, AccessMask '0x10000'). This activity could indicate a threat actor trying to evade detection by disabling or muting Sysmon logging.
Sigma
