huntrule

Windows ETW Logging Disabled via SCM Registry TracingDisabled Key

Detects SCM ETW logging being disabled by setting the TracingDisabled registry DWORD for services.exe.

FreeUnreviewedSigmalowv1
title: Windows ETW Logging Disabled via SCM Registry TracingDisabled Key
id: b0e16d73-02a0-4328-9ed3-62847267a1eb
status: test
description: This rule flags registry changes to the TracingDisabled DWORD for the Service Control Manager (SCM) under the ETW tracing configuration path. Setting this value to 0x00000001 disables ETW logging for services.exe (SCM), reducing visibility into system activity and potentially aiding defense evasion. It relies on registry set telemetry capturing the target object path and the specific DWORD value.
references:
  - http://redplait.blogspot.com/2020/07/whats-wrong-with-etw.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_services_etw_tamper.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-09
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
  - attack.t1685
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: Software\Microsoft\Windows NT\CurrentVersion\Tracing\SCM\Regular\TracingDisabled
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 4f281b83-0200-4b34-bf35-d24687ea57c2
    type: derived

What it detects

This rule flags registry changes to the TracingDisabled DWORD for the Service Control Manager (SCM) under the ETW tracing configuration path. Setting this value to 0x00000001 disables ETW logging for services.exe (SCM), reducing visibility into system activity and potentially aiding defense evasion. It relies on registry set telemetry capturing the target object path and the specific DWORD value.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.