Windows EventLog Autologger Session Registry Modification Via CommandLine

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing session records events that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685.001` Disable or Modify Tools: Disable or Modify Windows Event Log

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Windows EventLog Autologger Session Registry Modification Via CommandLine
id: d7b81144-b866-48a4-9bcc-275dc69d870e
related:
    - id: f37b4bce-49d0-4087-9f5b-58bffda77316
      type: similar
status: experimental
description: |
    Detects attempts to disable Windows EventLog autologger sessions via registry modification.
    The AutoLogger event tracing session records events that occur early in the operating system boot process.
    Applications and device drivers can use the AutoLogger session to capture traces before the user logs in.
    Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.
references:
    - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
    - https://ptylu.github.io/content/report/report.html?report=25
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-12-25
tags:
    - attack.defense-impairment
    - attack.t1685.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\reg.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'reg.exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cli_action:
        CommandLine|contains:
            - 'add '
            - 'Set-ItemProperty'
            - 'New-ItemProperty'
            - 'si ' # Set-ItemProperty alias
    selection_cli_base:
        CommandLine|contains: '\Control\WMI\Autologger\'
    selection_cli_key:
        CommandLine|contains:
            - 'Start' # Key used to disable specific autologger session like EventLog-Application, EventLog-System etc.
            - 'Enabled' # Key used to disable specific provider of autologger session
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification/info.yml
simulation:
    - type: atomic-red-team
      name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd
      technique: T1562.001
      atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab
    - type: atomic-red-team
      name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
      technique: T1562.001
      atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c
    - type: atomic-red-team
      name: Disable EventLog-Application ETW Provider Via Registry - Cmd
      technique: T1562.001
      atomic_guid: 1cac9b54-810e-495c-8aac-989e0076583b
    - type: atomic-red-team
      name: Disable EventLog-Application ETW Provider Via Registry - PowerShell
      technique: T1562.001
      atomic_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith:
          - '\reg.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'reg.exe'
          - 'PowerShell.EXE'
          - 'pwsh.dll'

Stage 2: `selection_cli_action`

selection_cli_action:
    CommandLine|contains:
        - 'add '
        - 'Set-ItemProperty'
        - 'New-ItemProperty'
        - 'si '

Stage 3: `selection_cli_base`

selection_cli_base:
    CommandLine|contains: '\Control\WMI\Autologger\'

Stage 4: `selection_cli_key`

selection_cli_key:
    CommandLine|contains:
        - 'Start'
        - 'Enabled'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`Enabled` corpus 2 (sigma 1, elastic 1) `New-ItemProperty` corpus 7 (sigma 7) `Set-ItemProperty` corpus 7 (sigma 7) `Start` corpus 13 (sigma 11, splunk 2) `\Control\WMI\Autologger\` `add` corpus 12 (sigma 12) `si` corpus 5 (sigma 5)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\powershell.exe` corpus 179 (sigma 178, kusto 1) `\pwsh.exe` corpus 165 (sigma 164, kusto 1) `\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`PowerShell.EXE` corpus 138 (sigma 84, splunk 30, elastic 24) `pwsh.dll` corpus 112 (sigma 79, splunk 30, elastic 3) `reg.exe` corpus 43 (sigma 32, splunk 8, elastic 3)	`field:"OriginalFileName" kind:eq`

Windows EventLog Autologger Session Registry Modification Via CommandLine

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli_action