Detection rules › Sigma

ETW Logging Tamper In .NET Processes Via CommandLine

Severity
high
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source
upstream

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1562 Impair Defenses

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection

or:
CommandLine|contains: COMPlus_ETWEnabled
CommandLine|contains: COMPlus_ETWFlags

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • COMPlus_ETWEnabled
  • COMPlus_ETWFlags