Detectionhightest

ETW Logging Tamper In .NET Processes Via CommandLine

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)Created Sat May 02Updated Fri Dec 0941421f44-58f9-455d-838a-c398859841d4windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains:
            - 'COMPlus_ETWEnabled'
            - 'COMPlus_ETWFlags'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

Resolving title…

twitter.com

Resolving title…

social.msdn.microsoft.com

managed670.rssing.com

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Techniques

T1562 · Impair Defenses

Rule Metadata

Rule ID

41421f44-58f9-455d-838a-c398859841d4

Status

test

Level

high

Type

Detection

Created

Sat May 02

Modified

Fri Dec 09

Author

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Path

rules/windows/process_creation/proc_creation_win_susp_etw_modification_cmdline.yml

Raw Tags

attack.defense-evasionattack.t1562

View on GitHub