Sysmon

Threat actors frequently utilize URL shortening services like TinyURL to obfuscate malicious URLs used in phishing campaigns, malware staging, or command-and-control (C2) communication.

Attackers achieve persistence and privilege escalation by modifying the Print Monitors registry key to force the system to load an arbitrary malicious DLL under SYSTEM privileges.

Adversaries abuse the Windows Credential UI DLLs to present fraudulent prompts for harvesting user credentials, a technique detectable by monitoring for suspicious module loads outside of protected system directories.

Threat actors abuse the Windows Task Scheduler service to execute malicious code and maintain persistence by spawning shell and scripting binaries directly from the svchost.exe service process.

This detection analytic identifies potential DLL search order hijacking by leveraging Sysmon to monitor for the loading of known vulnerable libraries from non-standard directory paths.

This brief outlines the detection of potential persistence and privilege escalation via WMI permanent event subscriptions, which attackers use to trigger malicious payloads on system events.

Detection of malicious processes attempting to terminate the Local Security Authority Subsystem Service (lsass.exe) using the PROCESS_TERMINATE access mask to facilitate system instability or disable security controls.

Detection of malicious process injection attempts into common Windows executables observed in frameworks like SliverC2 using suspicious access masks in Sysmon EventID 10 logs.

This brief details a detection capability for monitoring the creation of Portable Executable files using Sysmon Event ID 29 to identify unauthorized binary drops.

Detection of the default named pipe used by the RemCom remote administration tool, which is frequently leveraged by attackers for lateral movement and remote command execution.

Detection and mitigation guidance for identifying timestomping activity where adversaries modify creation timestamps of executable files in sensitive system directories to evade detection.

This brief describes how to detect an attacker updating or replacing the Sysmon configuration with a bare bones one to avoid monitoring without completely shutting down the service, leveraging Sysmon's `-c` command-line option for defense impairment.

This brief describes the detection of attackers uninstalling Sysinternals Sysmon, a critical endpoint monitoring tool, as a defense evasion technique to obscure malicious activities and maintain stealth.

This analytic detects instances where a process loads a file from a remote share path, potentially indicating execution, defense evasion, or lateral movement by attackers loading code from attacker-controlled infrastructure.

A suspicious process recursively deleting executable files (e.g., .exe, .sys, .dll) indicates potential data destruction activity, detected via high-volume file deletion/overwrite events associated with destructive malware families like CaddyWiper and SwiftSlicer.

Detects process creation events indicative of remote management tools, potentially signifying legitimate use or malicious exploitation by threat actors abusing RMM software.

This analytic detects suspicious raw access reads to the drive containing the Master Boot Record (MBR) using Sysmon EventCode 9, which is a common tactic used by attackers to wipe, encrypt, or overwrite the MBR as part of their impact payload.

Detection of potential DLL side-loading of Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe, or renamed BluetoothService.exe) via loading a malicious log.dll from a non-standard path.