Detection rules › Sigma
ETW Trace Evasion Activity
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1070 Indicator Removal, T1562.006 Impair Defenses: Indicator Blocking |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
| Security-Auditing | 4688 | A new process has been created. |
Stages and Predicates
Stage 1: 1 of selection_clear_1
CommandLine|contains: '/Trace'
CommandLine|contains: cl
Stage 2: 1 of selection_clear_2
CommandLine|contains: '/Trace'
CommandLine|contains: clear-log
Stage 3: 1 of selection_disable_1
CommandLine|contains: '/e:false'
CommandLine|contains: sl
Stage 4: 1 of selection_disable_2
CommandLine|contains: '/e:false'
CommandLine|contains: set-log
Stage 5: 1 of selection_disable_3
CommandLine|contains: --p
CommandLine|contains: -ets
CommandLine|contains: logman
CommandLine|contains: trace
CommandLine|contains: update
Stage 6: 1 of selection_pwsh_remove
CommandLine|contains: Remove-EtwTraceProvider
Stage 7: 1 of selection_pwsh_set
CommandLine|contains: 0x11
CommandLine|contains: Set-EtwTraceProvider
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|