HackTool - SysmonEnte Execution
This rule detects attempts to interact with Sysmon processes (Sysmon.exe or Sysmon64.exe) with specific access rights (0x1400), which is indicative of the SysmonEnte tool. It also directly looks for the string 'Ente' in the CallTrace, which is a unique identifier for SysmonEnte's activity. The rule filters out legitimate access from common program file locations and Microsoft Defender to reduce false positives.
Sigma
