Query: alert when Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
Matching passage: Sigma rule: Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.. Logsource: windows / process_creation. Rule: title: ETW Trace Evasion Activity id: a238b5d0-ce2d-4414-a676-7a531b3d13d6 status: test description: 'Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://abuse.io/lockergoga.txt - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: '@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community' date: 2019-03-22 modified: 2022-06-28 tags: - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1685 - car.2016-04-002 logsource: category: process_creation product: windows detection: selection_clear_1: CommandLine|contains|all: - cl - /Trace selection_clear_2: CommandLine|contains|all: - clear-log - /Trace selection_disable_1: CommandLine|contains|all: - sl - /e:false selection_disable_2: CommandLine|contains|all: - set-log - /e:false selection_disable_3: CommandLine|contains|all: - logman - update - trace - --p - -ets selection_pwsh_remove: CommandLine|contains: Remove-EtwTraceProvider selection_pwsh_set: CommandLine|contains|all: - Set-EtwTraceProvider - '0x11' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes,. Logsource: windows / process_creation. Rule: title: Service Reconnaissance Via Wmic.EXE id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae related: - id: 68bcd73b-37ef-49cb-95fc-edc809730be6 type: similar status: test description: 'An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 modified: 2026-01-07 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: service filter_main_manipulation: CommandLine|contains: - stopservice - startservice filter_main_win32_methods: CommandLine|contains: - Change - Create - Delete - PauseService - ResumeService - SetSecurityDescriptor - StartService - StopService - UserControlService condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Reconnaissance List Remote Services technique: T1047 atomic_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_service/info.yml