detection.wiki

Detection rules › Sigma

Windows EventLog Autologger Session Registry Modification Via CommandLine

Status
experimental
Severity
high
Log source
product windows, category process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing session records events that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.

MITRE ATT&CK coverage

TacticTechniques
Defense ImpairmentT1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Windows EventLog Autologger Session Registry Modification Via CommandLine
id: d7b81144-b866-48a4-9bcc-275dc69d870e
related:
    - id: f37b4bce-49d0-4087-9f5b-58bffda77316
      type: similar
status: experimental
description: |
    Detects attempts to disable Windows EventLog autologger sessions via registry modification.
    The AutoLogger event tracing session records events that occur early in the operating system boot process.
    Applications and device drivers can use the AutoLogger session to capture traces before the user logs in.
    Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.
references:
    - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
    - https://ptylu.github.io/content/report/report.html?report=25
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-12-25
tags:
    - attack.defense-impairment
    - attack.t1685.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\reg.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'reg.exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cli_action:
        CommandLine|contains:
            - 'add '
            - 'Set-ItemProperty'
            - 'New-ItemProperty'
            - 'si ' # Set-ItemProperty alias
    selection_cli_base:
        CommandLine|contains: '\Control\WMI\Autologger\'
    selection_cli_key:
        CommandLine|contains:
            - 'Start' # Key used to disable specific autologger session like EventLog-Application, EventLog-System etc.
            - 'Enabled' # Key used to disable specific provider of autologger session
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification/info.yml
simulation:
    - type: atomic-red-team
      name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd
      technique: T1562.001
      atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab
    - type: atomic-red-team
      name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
      technique: T1562.001
      atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c
    - type: atomic-red-team
      name: Disable EventLog-Application ETW Provider Via Registry - Cmd
      technique: T1562.001
      atomic_guid: 1cac9b54-810e-495c-8aac-989e0076583b
    - type: atomic-red-team
      name: Disable EventLog-Application ETW Provider Via Registry - PowerShell
      technique: T1562.001
      atomic_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith:
          - '\reg.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'reg.exe'
          - 'PowerShell.EXE'
          - 'pwsh.dll'

Stage 2: selection_cli_action

selection_cli_action:
    CommandLine|contains:
        - 'add '
        - 'Set-ItemProperty'
        - 'New-ItemProperty'
        - 'si '

Stage 3: selection_cli_base

selection_cli_base:
    CommandLine|contains: '\Control\WMI\Autologger\'

Stage 4: selection_cli_key

selection_cli_key:
    CommandLine|contains:
        - 'Start'
        - 'Enabled'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • Enabled corpus 2 (sigma 1, elastic 1)
  • New-ItemProperty corpus 7 (sigma 7)
  • Set-ItemProperty corpus 7 (sigma 7)
  • Start corpus 13 (sigma 11, splunk 2)
  • \Control\WMI\Autologger\
  • add corpus 12 (sigma 12)
  • si corpus 5 (sigma 5)
Imageends_with
  • \powershell.exe corpus 182 (sigma 182)
  • \pwsh.exe corpus 168 (sigma 168)
  • \reg.exe corpus 58 (sigma 58)
OriginalFileNameeq
  • PowerShell.EXE corpus 120 (sigma 84, splunk 30, elastic 6)
  • pwsh.dll corpus 112 (sigma 79, splunk 30, elastic 3)
  • reg.exe corpus 42 (sigma 32, splunk 8, elastic 2)