Sysmon Uninstall Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•0•13

This rule detects attempts to uninstall Sysmon by monitoring process creation events for Sysmon executables (Sysmon64.exe or Sysmon.exe) being run with the '-u' command-line argument. This activity is often indicative of an adversary attempting to evade detection by removing security tools.