Sysmon Configuration Update (87911521-7098-470b-a459-9a57fc80bdfd)
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely