Windows EventLog Autologger Session Registry Modification Via CommandLine
Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing session records events that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_img:
- Image|endswith:
- '\reg.exe'
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'reg.exe'
- 'PowerShell.EXE'
- 'pwsh.dll'
selection_cli_action:
CommandLine|contains:
- 'add '
- 'Set-ItemProperty'
- 'New-ItemProperty'
- 'si ' # Set-ItemProperty alias
selection_cli_base:
CommandLine|contains: '\Control\WMI\Autologger\'
selection_cli_key:
CommandLine|contains:
- 'Start' # Key used to disable specific autologger session like EventLog-Application, EventLog-System etc.
- 'Enabled' # Key used to disable specific provider of autologger session
condition: all of selection_*False positive likelihood has not been assessed. Additional context may be needed during triage.
Simulations
Disable EventLog-Application Auto Logger Session Via Registry - Cmd
GUID: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab
Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
GUID: da86f239-9bd3-4e85-92ed-4a94ef111a1c
Disable EventLog-Application ETW Provider Via Registry - Cmd
GUID: 1cac9b54-810e-495c-8aac-989e0076583b
Disable EventLog-Application ETW Provider Via Registry - PowerShell
GUID: 8f907648-1ebf-4276-b0f0-e2678ca474f0
Tactics
Sub-techniques