Sysmon Configuration Update

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2026•0•0•1

Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely