admin/trustedsec-SysmonCommunityGuide
1
0
Fork 0
mirror of https://github.com/trustedsec/SysmonCommunityGuide/ synced 2026-06-06 19:46:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix Table formatting

Browse Source 
Markdown formatting for Indicator/Can it be changed table was incorrect.
This commit is contained in:
Reedtechno
2020-02-06 16:54:03 -05:00
committed by GitHub
parent a54aacc2c3
commit faf0c4e59d
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install-and-configuration.md
+8 -8
View File
@@ -561,14 +561,14 @@ This does not mean that an attacker will not use more advanced methods to enumer
Detection of Sysmon is achieved by looking at the areas that cannot be changed.
**Indicator** **Can it be Changed**
---------------------------- -----------------------
Driver Name YES
Service Name YES
Registry Config Path YES
Driver altitude Number NO
EventLog Path and Name NO
Sysmon Service Description NO (Manually)
**Indicator** | **Can it be Changed**
----------------------------| -----------------------
|Driver Name| YES
|Service Name| YES
|Registry Config Path| YES
|Driver altitude Number| NO
|EventLog Path and Name| NO
|Sysmon Service Description| NO (Manually)
When Sysmon configuration is modified using the Sysmon command line tool, an **EventId 16** is generated. If the registry binary value is modified directly, no event is generated, and configuration is applied as soon as the value is modified.