Sigma rule: HackTool - SysmonEnte Execution

Rule

Title

HackTool - SysmonEnte Execution

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2022-09-07

Modified

2026-06-29

File

rules/windows/process_access/proc_access_win_hktl_sysmonente.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon

Log source

product

windows

category

process_access

Detection

selection_sysmon:
    TargetImage|contains:
        - ':\Windows\Sysmon.exe'
        - ':\Windows\Sysmon64.exe'
        - ':\Windows\Sysmon64a.exe'
    GrantedAccess: '0x1400'
selection_calltrace:
    CallTrace: 'Ente'
filter_main_generic:
    SourceImage|contains:
        - ':\Program Files (x86)\'
        - ':\Program Files\'
        - ':\Windows\System32\'
        - ':\Windows\SysWOW64\'
filter_main_msdefender:
    SourceImage|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
    SourceImage|endswith: '\MsMpEng.exe'
condition: ( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace

False positives (as the rule lists them)

• Unknown

Tags

• attack.defense-impairment
• attack.t1685.001

MITRE ATT&CK ids this rule names

• T1685.001

References

• https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html
• https://github.com/codewhitesec/SysmonEnte/
• https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_access/proc_access_win_hktl_sysmonente.yml