Sysmon Configuration Change Detected
This rule detects when the Sysmon configuration is changed. This event (EventID 16) is generated by Sysmon itself when its configuration is updated, which could be a legitimate administrative action to reconfigure Sysmon or an attempt by an adversary to manipulate its monitoring capabilities to evade detection.
Sigma
