Detection rules › Splunk

Windows Registry Dotnet ETW Disabled Via ENV Variable

Author
Nasreddine Bencherchali, Splunk
Source
upstream

The following analytic detects a registry modification that disables the ETW for the .NET Framework. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the COMPlus_ETWEnabled registry value under the "Environment" registry key path for both user (HKCU\Environment) and machine (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment) scopes. This activity is significant because disabling ETW can allow attackers to evade Endpoint Detection and Response (EDR) tools and hide their execution from audit logs. If confirmed malicious, this action could enable attackers to operate undetected, potentially leading to further compromise and persistent access within the environment.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1562.006 Impair Defenses: Indicator Blocking

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: tstats

tstats WHERE (Registry.registry_value_data=0 OR Registry.registry_value_data=0x000000000) Registry.registry_path="*\\Environment*" Registry.registry_value_name="COMPlus_ETWEnabled" BY Registry.action, Registry.dest, Registry.process_guid, Registry.process_id, Registry.registry_hive, Registry.registry_path, Registry.registry_key_name, Registry.registry_value_data, Registry.registry_value_name, Registry.registry_value_type, Registry.status, Registry.user, Registry.vendor_product

Stage 2: search

search

Stage 3: where

where isnotnull(registry_value_data)

Stage 4: search

search

Stage 5: search

search

Stage 6: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Registry.registry_patheq
  • "*\\Environment*"
Registry.registry_value_dataeq
  • 0 corpus 4 (sigma 3, splunk 1)
  • 0x000000000
Registry.registry_value_nameeq
  • "COMPlus_ETWEnabled"