Windows: Detect logman.exe commands stopping or deleting trace ETW sessions

title: "Windows: Detect logman.exe commands stopping or deleting trace ETW sessions"
id: 1d75c0a2-d51a-4e4f-a5cb-c8f6b2e62534
status: test
description: This rule flags execution of Logman.exe with command-line arguments used to stop or delete Windows trace sessions related to ETW providers. Attackers may use this to impair visibility by terminating logging before or during an intrusion. Detection relies on Windows process creation telemetry, matching the executed binary and specific command-line substrings targeting known trace session names.
references:
  - https://twitter.com/0gtweet/status/1359039665232306183?s=21
  - https://ss64.com/nt/logman.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_logman_disable_eventlog.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-02-11
modified: 2023-02-21
tags:
  - attack.defense-impairment
  - attack.t1685
  - attack.t1685.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \logman.exe
    - OriginalFileName: Logman.exe
  selection_action:
    CommandLine|contains:
      - "stop "
      - "delete "
  selection_service:
    CommandLine|contains:
      - Circular Kernel Context Logger
      - EventLog-
      - SYSMON TRACE
      - SysmonDnsEtwSession
  condition: all of selection*
falsepositives:
  - Legitimate deactivation by administrative staff
  - Installer tools that disable services, e.g. before log collection agent installation
level: high
license: DRL-1.1
related:
  - id: cd1f961e-0b96-436b-b7c6-38da4583ec00
    type: derived