Skip to content
Threat Feed
Subscribe

Tag

Attack.t1564

1 brief RSS
high advisory

Sysmon Configuration Error Detection

This brief describes how adversaries attempt to evade detection by deliberately triggering Sysmon configuration errors to hinder logging, which can be identified by specific error messages in Windows event logs.

Sysmon evasion attack.stealth attack.t1564
1r 1t