Skip to content
Sign In
Telemetry

win:sysmon 16

ServiceConfigurationChange

This event logs changes in the Sysmon configuration - for example when the filtering rules are updated.

Log source
Sysmon
Host type
Windows (workstation, member server, domain controller)
How to enable
Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
Tier, host type
Listed
Techniques
0
Rules depending on it
Sigma 2

Why this tier

By role

RoleTierBasis
Windows workstationListed
Windows member serverListed
Windows domain controllerListed
Windows web server (IIS), internet-facingListed

Techniques it helps detect

No ATT&CK analytic names this event. Its standing comes from the standards and rules below.

Rules that depend on it

Sigma 2

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.