Sysmon Configuration Update Detected
This rule detects when the Sysmon utility is executed with the '-c' command-line argument, indicating an attempt to update or modify its configuration. Attackers might leverage this to disable or alter Sysmon's monitoring capabilities, thereby evading detection without fully shutting down the service.
Sigma
