Sysmon Discovery via Driver Altitude Search

Security software discovery is a critical reconnaissance step for threat actors seeking to evade detection or disable security controls. A known technique for identifying Sysmon installations involves querying the system for the presence of the default Sysmon driver altitude, 385201. Attackers use common Windows binaries like findstr.exe or find.exe to search for this specific altitude value within the output of system commands or registry queries. Because the driver altitude is tied to the kernel-mode driver registration and not the user-mode service name, this method remains effective even when defenders attempt to obfuscate Sysmon by renaming the service executable. Monitoring for these specific command-line arguments allows security operations teams to detect reconnaissance activity before an attacker attempts to disable or bypass monitoring capabilities.

Attack Chain

1. Attacker establishes initial access on a Windows endpoint.
2. Attacker executes system discovery commands to identify installed security tools.
3. Attacker uses a command like "fltmc filters" or "reg query" to list installed drivers or registry keys.
4. Attacker pipes the output of these commands into "findstr.exe 385201" or "find.exe 385201".
5. The utility identifies the specific registry entry or filter list containing the Sysmon driver altitude.
6. The process concludes by confirming the presence and path of the Sysmon driver.
7. Attacker proceeds to disable the identified security service or clear the configuration.

Impact

Successful reconnaissance allows attackers to map the defense-in-depth posture of an organization, specifically targeting security instrumentation for neutralization. Once identified, Sysmon instances can be uninstalled, stopped, or have their configuration modified to evade detection of further malicious actions, potentially leading to long-term persistence and unauthorized exfiltration of sensitive data.

Recommendation

Deploy the provided Sigma rule to monitor for suspicious usage of findstr.exe or find.exe targeting the Sysmon driver altitude. Enable Sysmon or Windows Event Log (Event ID 4688) process-creation logging to ensure command-line arguments are captured and forwarded to the SIEM.