Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
106 detections
Filters
Last updated
All Time
Detection languages
58
33
7
2
2
Contributors
22
14
11
8
8
Categories
48
21
15
12
11
Platforms
84
8
4
3
3
Products / Services
21
19
15
6
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects when an attacker attempts to disable or modify Sysmon's configuration to evade detection. This rule specifically looks for Sysmon's state changing to 'Stopped' or a 'Sysmon config state changed' event occurring when Sysmon was not already in a 'Started' state.
Page 6 of 6