{"id":"a238b5d0-ce2d-4414-a676-7a531b3d13d6","title":"ETW Trace Evasion Activity","description":"Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.\n","author":"@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2019-03-22","modified":"2022-06-28","tags":["attack.stealth","attack.defense-impairment","attack.t1070","attack.t1685","car.2016-04-002"],"technique_ids":["T1070","T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil","https://abuse.io/lockergoga.txt","https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml","source_sha256":"f883d161d3a510e54a3baa3e54ecc22fe4cb515a6569cb1b59df03688215df5b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ETW Trace Evasion Activity\nid: a238b5d0-ce2d-4414-a676-7a531b3d13d6\nstatus: test\ndescription: |\n    Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil\n    - https://abuse.io/lockergoga.txt\n    - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63\nauthor: '@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community'\ndate: 2019-03-22\nmodified: 2022-06-28\ntags:\n    - attack.stealth\n    - attack.defense-impairment\n    - attack.t1070\n    - attack.t1685\n    - car.2016-04-002\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_clear_1:\n        CommandLine|contains|all:\n            - 'cl'\n            - '/Trace'\n    selection_clear_2:\n        CommandLine|contains|all:\n            - 'clear-log'\n            - '/Trace'\n    selection_disable_1:\n        CommandLine|contains|all:\n            - 'sl'\n            - '/e:false'\n    selection_disable_2:\n        CommandLine|contains|all:\n            - 'set-log'\n            - '/e:false'\n    selection_disable_3:   # ETW provider removal from a trace session\n        CommandLine|contains|all:\n            - 'logman'\n            - 'update'\n            - 'trace'\n            - '--p'\n            - '-ets'\n    selection_pwsh_remove:   # Autologger provider removal\n        CommandLine|contains: 'Remove-EtwTraceProvider'\n    selection_pwsh_set:   # Provider “Enable” property modification\n        CommandLine|contains|all:\n            - 'Set-EtwTraceProvider'\n            - '0x11'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1070","id":"T1070","name":"Indicator Removal","page":"techniques/enterprise/T1070/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/a238b5d0-ce2d-4414-a676-7a531b3d13d6.json","kind":"sigma"}