Sysmon/ETW Telemetry Tamper Response (Active Service/Driver Removal)
When an EID 4 service-stopped alert or an EID 16 unexpected configuration change indicates active interference with telemetry infrastructure, restores visibility using an evidence-first approach and investigates the attacker's evasion motivation.
Prepare
7 steps- Keep Sysmon deployment inventory current
Record which Sysmon version and which configuration profile is running on each endpoint (DC, workstation, server, legacy) in CMDB or a GPO table; impact analysis cannot be performed without an inventory
- Keep EID 4 and EID 16 alerts live
Deploy real-time alert rules in SIEM for `Microsoft-Windows-Sysmon/Operational` EID 4 (service state change) and EID 16 (configuration change) and test them periodically
- Calibrate the telemetry stream alert (log gap)
Deploy a rule that generates an alert when EID 1 stream from an endpoint is interrupted for N minutes (similar to DR-6); adjust the `expectedInterval` value according to the environment baseline
- Deploy honey-process / decoy SPN
Any access to a target process or account with no legitimate use is evaluated as a high-confidence signal; verify that the alert is live
- Keep approved Sysmon config and binary in a central repository
Confirm the unmodified integrity (SHA256) of `sysmon64.exe` and `approved-config.xml` with a change management record; they must be accessible for emergency reinstallation