rules/windows/process_creation/proc_creation_win_uninstall_sysmon.yml

title: Uninstall Sysinternals Sysmon 
id: 6a5f68d1-c4b5-46b9-94ee-5324892ea939
status: experimental
description: Detects the uninstallation of Sysinternals Sysmon, which could be the result of legitimate administration or a manipulation for defense evasion
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-11---uninstall-sysmon
author: frack113
date: 2022/01/12
logsource:
    category: process_creation
    product: windows
detection:
    sysmon:
        Image|endswith: 
            - \Sysmon64.exe
            - \Sysmon.exe
        CommandLine|contains: '-u'
    condition: sysmon
falsepositives:
    - Unknown
level: high
tags:
    - attack.defense_evasion
    - attack.t1562.001
$frack113$ Windows Redcannary 2022-01-12 20:27:56 +01:00			`title: Uninstall Sysinternals Sysmon`
			`id: 6a5f68d1-c4b5-46b9-94ee-5324892ea939`
			`status: experimental`
Update win_pc_uninstall_sysmon.yml 2022-01-13 21:07:59 +01:00			`description: Detects the uninstallation of Sysinternals Sysmon, which could be the result of legitimate administration or a manipulation for defense evasion`
$frack113$ Windows Redcannary 2022-01-12 20:27:56 +01:00			`references:`
			`- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-11---uninstall-sysmon`
			`author: frack113`
			`date: 2022/01/12`
			`logsource:`
			`category: process_creation`
			`product: windows`
			`detection:`
			`sysmon:`
			`Image\|endswith:`
			`- \Sysmon64.exe`
			`- \Sysmon.exe`
			`CommandLine\|contains: '-u'`
			`condition: sysmon`
			`falsepositives:`
fix: unknown --> Unknown 2022-03-16 13:43:54 +01:00			`- Unknown`
$frack113$ Windows Redcannary 2022-01-12 20:27:56 +01:00			`level: high`
			`tags:`
			`- attack.defense_evasion`
Update win_pc_uninstall_sysmon.yml 2022-01-13 21:07:59 +01:00			`- attack.t1562.001`