Technique Search Instance

HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 182,
    "key": "unloading-sysmon-driver",
    "unprotect_id": "U0407",
    "name": "Unloading Sysmon Driver",
    "description": "Sysmon is a tool that can be used to monitor system activity on Windows systems. It records various types of events, such as process creation, network connections, and registry changes, and stores them in the Windows Event Log. Security analysts can use this information to detect and investigate malicious activity on a system.\r\n\r\nOne way that malware can evade detection by Sysmon is by unloading the Sysmon driver. The Sysmon driver is the kernel-mode component of Sysmon that is responsible for recording the events that Sysmon monitors. By unloading this driver, the malware can prevent Sysmon from recording any further events, and thus avoid being detected.",
    "resources": "https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver",
    "creation_date": "2022-06-19T05:53:40.014000Z",
    "tags": "Sysmon,\r\nsystem activity,\r\nprocess creation,\r\nnetwork connections,\r\nregistry changes,\r\nWindows Event Log,\r\nSysmon driver,",
    "modification_date": "2023-10-04T10:43:01.150000Z",
    "category": [
        6
    ],
    "rules": [
        128
    ],
    "attachments": [],
    "featured_api": [
        425
    ],
    "contributors": []
}