Windows ETW Trace Evasion via Clearing/Disabling Logs or Providers

title: Windows ETW Trace Evasion via Clearing/Disabling Logs or Providers
id: 07dc3a95-f701-4070-b932-dfdddaed436d
status: test
description: This rule flags Windows process creation commands attempting to clear or disable ETW trace logs, as well as remove or modify ETW trace providers. Such actions can reduce or impair forensic visibility and are commonly used as defense-impairment and stealth techniques. It relies on process creation telemetry with command-line fields matching indicative wevtutil-style parameters, logman trace updates, and PowerShell ETW provider cmdlets.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
  - https://abuse.io/lockergoga.txt
  - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml
author: "@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team"
date: 2019-03-22
modified: 2022-06-28
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1070
  - attack.t1685
  - car.2016-04-002
logsource:
  category: process_creation
  product: windows
detection:
  selection_clear_1:
    CommandLine|contains|all:
      - cl
      - /Trace
  selection_clear_2:
    CommandLine|contains|all:
      - clear-log
      - /Trace
  selection_disable_1:
    CommandLine|contains|all:
      - sl
      - /e:false
  selection_disable_2:
    CommandLine|contains|all:
      - set-log
      - /e:false
  selection_disable_3:
    CommandLine|contains|all:
      - logman
      - update
      - trace
      - --p
      - -ets
  selection_pwsh_remove:
    CommandLine|contains: Remove-EtwTraceProvider
  selection_pwsh_set:
    CommandLine|contains|all:
      - Set-EtwTraceProvider
      - "0x11"
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a238b5d0-ce2d-4414-a676-7a531b3d13d6
    type: derived