Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

ETW Logging Disabled In .NET Processes - Registry

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)Created Fri Jun 05Updated Tue Dec 20a4c90ea1-2634-4ca0-adbb-35eae169b6fcwindows
Log Source
Windowssecurity
ProductWindows← raw: windows
Servicesecurity← raw: security
Detection Logic
Detection Logic2 selectors
detection:
    selection_etw_enabled:
        EventID: 4657
        ObjectName|endswith: '\SOFTWARE\Microsoft\.NETFramework'
        ObjectValueName: 'ETWEnabled'
        NewValue: 0
    selection_complus:
        EventID: 4657
        ObjectName|contains: '\Environment'
        ObjectValueName:
            - 'COMPlus_ETWEnabled'
            - 'COMPlus_ETWFlags'
        NewValue: 0
    condition: 1 of selection_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
twitter.com
2
Resolving title…
social.msdn.microsoft.com
3
Resolving title…
github.com
4
Resolving title…
github.com
5
Resolving title…
github.com
6
Resolving title…
github.com
7
Resolving title…
bunnyinside.com
8
Resolving title…
managed670.rssing.com
9
Resolving title…
github.com
10
Resolving title…
i.blackhat.com
MITRE ATT&CK
Related Rules
SimilarDetectionhigh

ETW Logging Disabled In .NET Processes - Sysmon Registry

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata
Rule ID
a4c90ea1-2634-4ca0-adbb-35eae169b6fc
Status
test
Level
high
Type
Detection
Created
Fri Jun 05
Modified
Tue Dec 20
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Path
rules/windows/builtin/security/win_security_dot_net_etw_tamper.yml
Raw Tags
attack.persistenceattack.defense-evasionattack.t1112attack.t1562
View on GitHub