Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

ETW Logging Disabled In .NET Processes - Sysmon Registry

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)Created Fri Jun 05Updated Thu Aug 17bf4fc428-dcc3-4bbd-99fe-2422aeee2544windows
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic2 selectors
detection:
    selection_etw_enabled:
        TargetObject|endswith: 'SOFTWARE\Microsoft\.NETFramework\ETWEnabled'
        Details: 'DWORD (0x00000000)'
    selection_complus:
        TargetObject|endswith:
            - '\COMPlus_ETWEnabled'
            - '\COMPlus_ETWFlags'
        Details:
            - 0 # For REG_SZ type
            - 'DWORD (0x00000000)'
    condition: 1 of selection_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
twitter.com
2
Resolving title…
social.msdn.microsoft.com
3
Resolving title…
github.com
4
Resolving title…
github.com
5
Resolving title…
github.com
6
Resolving title…
github.com
7
Resolving title…
bunnyinside.com
8
Resolving title…
managed670.rssing.com
9
Resolving title…
github.com
10
Resolving title…
blog.xpnsec.com
11
Resolving title…
i.blackhat.com
MITRE ATT&CK
Related Rules
SimilarDetectionhigh

ETW Logging Disabled In .NET Processes - Registry

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata
Rule ID
bf4fc428-dcc3-4bbd-99fe-2422aeee2544
Status
test
Level
high
Type
Detection
Created
Fri Jun 05
Modified
Thu Aug 17
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Path
rules/windows/registry/registry_set/registry_set_dot_net_etw_tamper.yml
Raw Tags
attack.persistenceattack.defense-evasionattack.t1112attack.t1562
View on GitHub