Query: detection rule: Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. The AutoLogg
Matching passage: Sigma rule: Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. The AutoLogg. Logsource: windows / registry_set. Rule: title: Potential AutoLogger Sessions Tampering id: f37b4bce-49d0-4087-9f5b-58bffda77316 related: - id: d7b81144-b866-48a4-9bcc-275dc69d870e type: similar status: test description: 'Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. The AutoLogger event tracing session records events up that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in, and also used by security solutions as telemetry source. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events. ' references: - https://twitter.com/MichalKoczwara/status/1553634816016498688 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2025-12-26 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection_main: TargetObject|contains: \Control\WMI\Autologger\ selection_values: TargetObject|contains: - \EventLog- - \Defender TargetObject|endswith: - \Enabled - \Start Details: DWORD (0x00000000) filter_main_wevtutil: Image: C:\Windows\system32\wevtutil.exe filter_main_defender: Image|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ - C:\Program Files (x86)\Windows Defender\ Image|endswith: \MsMpEng.exe TargetObject|contains: - \DefenderApiLogger\ - \DefenderAuditLogger\ condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_autologger_sessions/info.yml simulation: - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd technique: T1562.001 atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell technique: T1562.001 atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c - type:
Near-miss passage: Sigma rule: Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll,. Logsource: zeek / http. Rule: title: HTTP Request to Low Reputation TLD or Suspicious File Extension id: 68c2c604-92ad-468b-bf4a-aac49adad08c status: experimental description: 'Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity. ' references: - https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows - https://www.spamhaus.org/reputation-statistics/cctlds/domains/ author: '@signalblur, Corelight' date: 2025-02-26 tags: - attack.initial-access - attack.command-and-control logsource: product: zeek service: http detection: selection_suspicious_tld: host|endswith: - .bid - .by - .cf - .click - .cm - .ga - .gq - .ir - .kp - .loan - .ml - .mm - .party - .pw - .ru - .su - .sy - .tk - .top - .tv - .ve - .work - .xyz selection_malicious_ext: uri|endswith: - .bat - .bin - .cmd - .cpl - .dll - .dylib - .elf - .exe - .hta - .iso - .jar - .js - .lnk - .msi - .pif - .ps1 - .py - .reg - .scr - .sh - .so - .vbs - .wsf selection_malicious_mime: resp_mime_types: - application/vnd.microsoft.portable-executable - application/x-bat - application/x-dosexec - application/x-elf - application/x-iso9660-image - application/x-java-archive - application/x-ms-shortcut - application/x-msdos-program - application/x-msdownload - application/x-python-code - application/x-sh condition: selection_suspicious_tld and 1 of selection_malicious_* falsepositives: - Rare legitimate software downloads from low quality TLDs level: medium