Sysmon v15.14

OK in the file I had on my test I box had this (A slight variation )

<Sysmon schemaversion="4.90">

	<DnsLookup></DnsLookup>
	<DriverName>AudiusSv</DriverName>

	<EventFiltering>

		<RuleGroup name="" groupRelation="or">
			<ProcessCreate onmatch="include" />
		</RuleGroup>

		<RuleGroup name="" groupRelation="or">
			<ProcessTerminate onmatch="include" />
		</RuleGroup>

	</EventFiltering>
</Sysmon>

There is a a DnsLookup directive. After some testing I have learned that if you enter anything Above the DriverName directive with a blank value, then the DriverName directive is ignored.

I assumed it would be OK to leave the directive blank since it has a default value of "True". But apparently leaving blank values above the DriverName directive breaks things. It just ignores the directives without giving any error.

As for the documentation:

Entry		Value	Description
DriverName	String	Uses specified name for driver and service images.

It still doesn't change the service name as the documentation states.
I will just rename the executable.

Thanks for the assist and your prompt replies.