Sysmon Events
This page gathers Sysmon related events that might indicate tampering. The following triggers are populated on occurence.
- Sysmon Config changes
- Suspicous Sysmon Config changes
- Sysmon Registry modifications by untrusted applications
- Sysmon state changes
For any configuration that Sysmon loads it generates a hash of the config file. Any change to the configuration that is loaded on a machine is logged here.
For any configuration that Sysmon loads it generates a hash of the config file. This new hash should be documented in the included lookuplist; trusted-sysmon-configurations.csv Any unknown change to the configuration that is loaded on a machine is logged here.
If an application apart from sysmon.exe is attempting to write to the sysmon configuration registry keys there will be a trigger here.
When the sysmon services changes state an event will be visible here