Query: write Sigma for Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing
Matching passage: Sigma rule: Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing. Logsource: windows / process_creation. Rule: title: Windows EventLog Autologger Session Registry Modification Via CommandLine id: d7b81144-b866-48a4-9bcc-275dc69d870e related: - id: f37b4bce-49d0-4087-9f5b-58bffda77316 type: similar status: experimental description: 'Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing session records events that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events. ' references: - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session - https://ptylu.github.io/content/report/report.html?report=25 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \reg.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - reg.exe - PowerShell.EXE - pwsh.dll selection_cli_action: CommandLine|contains: - 'add ' - Set-ItemProperty - New-ItemProperty - 'si ' selection_cli_base: CommandLine|contains: \Control\WMI\Autologger\ selection_cli_key: CommandLine|contains: - Start - Enabled condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification/info.yml simulation: - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd technique: T1562.001 atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell technique: T1562.001 atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c - type: atomic-red-team name: Disable EventLog-Application ETW Provider Via Registry - Cmd technique: T1562.001 atomic_guid: 1cac9b54-810e-495c-8aac-989e0076583b - type: atomic-red-team name: Disable EventLog-Application ETW Provider Via Registry - PowerShell technique: T1562.001 atomic_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0
Near-miss passage: Sigma rule: Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection s. Logsource: windows / security. Rule: title: New or Renamed User Account with '$' Character id: cfeed607-6aa4-4bbd-9627-b637deb723c8 status: test description: 'Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms. ' references: - https://twitter.com/SBousseaden/status/1387743867663958021 author: Ilyas Ochkov, oscd.community date: 2019-10-25 modified: 2024-01-16 tags: - attack.stealth - attack.t1036 logsource: product: windows service: security detection: selection_create: EventID: 4720 SamAccountName|contains: $ selection_rename: EventID: 4781 NewTargetUserName|contains: $ filter_main_homegroup: EventID: 4720 TargetUserName: HomeGroupUser$ condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium