detection.wiki

Detection rules › Sigma

Disabling Windows Defender WMI Autologger Session via Reg.exe

Status
experimental
Severity
high
Log source
product windows, category process_creation
Author
Matt Anderson (Huntress)
Source
github.com/SigmaHQ/sigma

Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.

MITRE ATT&CK coverage

TacticTechniques
Defense ImpairmentT1685 Disable or Modify Tools

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Disabling Windows Defender WMI Autologger Session via Reg.exe
id: a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6
related:
    - id: f37b4bce-49d0-4087-9f5b-58bffda77316
      type: similar
status: experimental
description: |
    Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events.
    By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events
    from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.
references:
    - https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/
    - https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
    - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
    - https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions
author: Matt Anderson (Huntress)
date: 2025-07-09
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_reg_path:
        CommandLine|contains:
            - '\Control\WMI\Autologger\DefenderApiLogger\Start'
            - '\Control\WMI\Autologger\DefenderAuditLogger\Start'
    selection_reg_add:
        CommandLine|contains|all:
            - 'add'
            - '0'
    filter_main_enable:
        CommandLine|contains: '0x00000001'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Highly unlikely
level: high

Stages and Predicates

Stage 0: condition

all of selection_* and not 1 of filter_main_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 2: selection_reg_path

selection_reg_path:
    CommandLine|contains:
        - '\Control\WMI\Autologger\DefenderApiLogger\Start'
        - '\Control\WMI\Autologger\DefenderAuditLogger\Start'

Stage 3: selection_reg_add

selection_reg_add:
    CommandLine|contains|all:
        - 'add'
        - '0'

Stage 4: not filter_main_enable

filter_main_enable:
    CommandLine|contains: '0x00000001'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
CommandLinematch0x00000001

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • 0 corpus 5 (sigma 5)
  • \Control\WMI\Autologger\DefenderApiLogger\Start
  • \Control\WMI\Autologger\DefenderAuditLogger\Start
  • add corpus 34 (sigma 26, splunk 4, chronicle 2, kusto 2)
Imageends_with
  • \reg.exe corpus 58 (sigma 58)
OriginalFileNameeq
  • reg.exe corpus 42 (sigma 32, splunk 8, elastic 2)