Disabling Windows Defender WMI Autologger Session via Reg.exe

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: Matt Anderson (Huntress)
Source: github.com/SigmaHQ/sigma

Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.

Known false positives

Highly unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Disabling Windows Defender WMI Autologger Session via Reg.exe
id: a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6
related:
    - id: f37b4bce-49d0-4087-9f5b-58bffda77316
      type: similar
status: experimental
description: |
    Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events.
    By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events
    from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.
references:
    - https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/
    - https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
    - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
    - https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions
author: Matt Anderson (Huntress)
date: 2025-07-09
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_reg_path:
        CommandLine|contains:
            - '\Control\WMI\Autologger\DefenderApiLogger\Start'
            - '\Control\WMI\Autologger\DefenderAuditLogger\Start'
    selection_reg_add:
        CommandLine|contains|all:
            - 'add'
            - '0'
    filter_main_enable:
        CommandLine|contains: '0x00000001'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Highly unlikely
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_main_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 2: `selection_reg_path`

selection_reg_path:
    CommandLine|contains:
        - '\Control\WMI\Autologger\DefenderApiLogger\Start'
        - '\Control\WMI\Autologger\DefenderAuditLogger\Start'

Stage 3: `selection_reg_add`

selection_reg_add:
    CommandLine|contains|all:
        - 'add'
        - '0'

Stage 4: `not filter_main_enable`

filter_main_enable:
    CommandLine|contains: '0x00000001'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`0x00000001`	`excludes:CommandLine` `field:"CommandLine" value:"0x00000001"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`0` corpus 6 (sigma 6) `\Control\WMI\Autologger\DefenderApiLogger\Start` `\Control\WMI\Autologger\DefenderAuditLogger\Start` `add` corpus 34 (sigma 26, splunk 4, chronicle 2, kusto 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with value:"\reg.exe"`
`OriginalFileName`	eq	`reg.exe` corpus 43 (sigma 32, splunk 8, elastic 3)	`field:"OriginalFileName" kind:eq value:"reg.exe"`