Query: Sigma rule for Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. The AutoLogg
Matching passage: Sigma rule: Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. The AutoLogg. Logsource: windows / registry_set. Rule: title: Potential AutoLogger Sessions Tampering id: f37b4bce-49d0-4087-9f5b-58bffda77316 related: - id: d7b81144-b866-48a4-9bcc-275dc69d870e type: similar status: test description: 'Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. The AutoLogger event tracing session records events up that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in, and also used by security solutions as telemetry source. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events. ' references: - https://twitter.com/MichalKoczwara/status/1553634816016498688 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2025-12-26 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection_main: TargetObject|contains: \Control\WMI\Autologger\ selection_values: TargetObject|contains: - \EventLog- - \Defender TargetObject|endswith: - \Enabled - \Start Details: DWORD (0x00000000) filter_main_wevtutil: Image: C:\Windows\system32\wevtutil.exe filter_main_defender: Image|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ - C:\Program Files (x86)\Windows Defender\ Image|endswith: \MsMpEng.exe TargetObject|contains: - \DefenderApiLogger\ - \DefenderAuditLogger\ condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_autologger_sessions/info.yml simulation: - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd technique: T1562.001 atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell technique: T1562.001 atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c - type:
Near-miss passage: Sigma rule: Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To Visual Studio Code Tunnels Domain id: 4b657234-038e-4ad5-997c-4be42340bce4 related: - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 type: similar - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 type: similar - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b type: similar status: test description: 'Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://cydefops.com/vscode-data-exfiltration author: Kamran Saifullah date: 2023-11-20 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1572 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: .tunnels.api.visualstudio.com condition: selection falsepositives: - Legitimate use of Visual Studio Code tunnel will also trigger this. level: medium