Sysmon Application Crashed

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•19

This rule detects when the Sysmon service crashes, indicated by an 'Application Popup' event with EventID 26 and a caption explicitly mentioning 'sysmon.exe - Application Error' or 'sysmon64.exe - Application Error'. This could signify an attempt to impair or disable Sysmon, which is a critical defense mechanism for endpoint monitoring.