From fc2e2aa4c5761fbd49932d67d883b75829746138 Mon Sep 17 00:00:00 2001 From: Tim Shelton Date: Thu, 2 Dec 2021 20:38:58 +0000 Subject: [PATCH] adding filter for false positive. no risk to sysmon operation --- rules/windows/sysmon/sysmon_config_modification_error.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/rules/windows/sysmon/sysmon_config_modification_error.yml b/rules/windows/sysmon/sysmon_config_modification_error.yml index 9d97fafb4..7403155f3 100644 --- a/rules/windows/sysmon/sysmon_config_modification_error.yml +++ b/rules/windows/sysmon/sysmon_config_modification_error.yml @@ -4,7 +4,7 @@ description: Someone try to hide from Sysmon status: experimental author: frack113 date: 2021/06/04 -modified: 2021/11/12 +modified: 2021/12/02 references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html @@ -20,8 +20,8 @@ detection: - 'Failed to open service configuration with error' - 'Failed to connect to the driver to update configuration' selection_filter: - Description: 'Failed to open service configuration with error 19' - condition: selection_error + Description: 'Failed to open service configuration with error 19 - Last error: The media is write protected.' + condition: selection_error and not selection_filter falsepositives: - legitimate administrative action -level: high \ No newline at end of file +level: high