Windows ETW Trace Evasion via Clearing/Disabling Logs or Providers
Identifies command-line attempts to clear/disable ETW traces or remove/modify ETW providers on Windows.
- Product
- windows
- Category
- process_creation
- Author
- @neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-03-22
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation commands attempting to clear or disable ETW trace logs, as well as remove or modify ETW trace providers. Such actions can reduce or impair forensic visibility and are commonly used as defense-impairment and stealth techniques. It relies on process creation telemetry with command-line fields matching indicative wevtutil-style parameters, logman trace updates, and PowerShell ETW provider cmdlets.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
- abuse.iohttps://abuse.io/lockergoga.txt
- medium.comhttps://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows ETW Trace Evasion via Clearing/Disabling Logs or Providers
id: 07dc3a95-f701-4070-b932-dfdddaed436d
status: test
description: This rule flags Windows process creation commands attempting to clear or disable ETW trace logs, as well as remove or modify ETW trace providers. Such actions can reduce or impair forensic visibility and are commonly used as defense-impairment and stealth techniques. It relies on process creation telemetry with command-line fields matching indicative wevtutil-style parameters, logman trace updates, and PowerShell ETW provider cmdlets.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
- https://abuse.io/lockergoga.txt
- https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml
author: "@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team"
date: 2019-03-22
modified: 2022-06-28
tags:
- attack.stealth
- attack.defense-impairment
- attack.t1070
- attack.t1685
- car.2016-04-002
logsource:
category: process_creation
product: windows
detection:
selection_clear_1:
CommandLine|contains|all:
- cl
- /Trace
selection_clear_2:
CommandLine|contains|all:
- clear-log
- /Trace
selection_disable_1:
CommandLine|contains|all:
- sl
- /e:false
selection_disable_2:
CommandLine|contains|all:
- set-log
- /e:false
selection_disable_3:
CommandLine|contains|all:
- logman
- update
- trace
- --p
- -ets
selection_pwsh_remove:
CommandLine|contains: Remove-EtwTraceProvider
selection_pwsh_set:
CommandLine|contains|all:
- Set-EtwTraceProvider
- "0x11"
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: a238b5d0-ce2d-4414-a676-7a531b3d13d6
type: derived