PowerShell disables or removes ETW trace providers via ETW cmdlets

title: PowerShell disables or removes ETW trace providers via ETW cmdlets
id: a77a4d4e-e46e-42af-b4b8-1590fe04ce8f
related:
  - id: a238b5d0-ce2d-4414-a676-7a531b3d13d6
    type: derived
  - id: 115fdba9-f017-42e6-84cf-d5573bf2ddf8
    type: derived
status: test
description: This rule identifies PowerShell script activity that removes ETW trace providers or modifies an ETW provider's enable property. Disabling or removing ETW tracing can reduce an attacker’s visibility by impairing host telemetry. The detection relies on PowerShell Script Block Logging content matching specific ETW-related cmdlet usage and provider configuration values.
references:
  - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_etw_trace_evasion.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2022-11-25
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1070
  - attack.t1685
  - car.2016-04-002
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_pwsh_remove:
    ScriptBlockText|contains: "Remove-EtwTraceProvider "
  selection_pwsh_set:
    ScriptBlockText|contains|all:
      - "Set-EtwTraceProvider "
      - "0x11"
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1