Windows Process Creation: ETW Trace Evasion via wevtutil, logman, and PowerShell

Identifies command-line attempts to clear/disable ETW traces or remove/modify ETW providers on Windows.

FreeReviewedSigma · High · v3

Product: windows
Category: process_creation
Author: @neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
Published: 2019-03-22
Updated: 2026-10-13

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070Indicator Removal
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process executions where attackers attempt to impair Event Tracing for Windows (ETW) by clearing event trace logs, disabling trace sessions, or removing/modifying ETW providers. Such actions can reduce telemetry coverage and blind security tooling by limiting visibility into system and application activity. Detection relies on process creation telemetry capturing the executable image and command-line arguments for wevtutil, logman, and PowerShell cmdlets like Remove-EtwTraceProvider and Set-EtwTraceProvider.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange

Suspicious Clearing of hosts.deny Access Restrictions on Linux

PowerShell Disable or Remove ETW Trace Sessions

Malicious Microsoft Defender Disabled via Registry DisableAntiSpyware (via process_creation)

Suspicious Termination of Defender Tray Process via Taskkill

Malicious Windows Defender Disablement via MpCmdRun RemoveDefinitions

Malicious Unsigned VIB Installation on ESXi Host via esxcli (via process_creation)

Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)

Malicious EDR Evasion Driver Load from AnyDesk Directory via k.sys (via image_load)

Malicious Zemana Vulnerable Driver Load for EDR Termination (via image_load)

Windows Process Creation: ETW Trace Evasion via wevtutil, logman, and PowerShell

Pivot detection · T1685 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-10-13
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-etw-trace-evasion-via-clearing-disabling-logs-or-providers-a238b5d0

title: "Windows Process Creation: ETW Trace Evasion via wevtutil, logman, and PowerShell"
id: 07dc3a95-f701-4070-b932-dfdddaed436d
status: test
description: This rule identifies Windows process executions where attackers attempt to impair Event Tracing for Windows (ETW) by clearing event trace logs, disabling trace sessions, or removing/modifying ETW providers. Such actions can reduce telemetry coverage and blind security tooling by limiting visibility into system and application activity. Detection relies on process creation telemetry capturing the executable image and command-line arguments for wevtutil, logman, and PowerShell cmdlets like Remove-EtwTraceProvider and Set-EtwTraceProvider.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
  - https://abuse.io/lockergoga.txt
  - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml
author: "@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team"
date: 2019-03-22
modified: 2026-10-12
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1070
  - attack.t1685
  - car.2016-04-002
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil_img:
    - Image|endswith: \wevtutil.exe
    - OriginalFileName: wevtutil.exe
  selection_wevtutil_cli_clear:
    CommandLine|contains:
      - " cl "
      - clear-log
    CommandLine|contains|windash: /Trace
  selection_wevtutil_cli_disable:
    CommandLine|contains:
      - " sl "
      - set-log
    CommandLine|contains|windash: /e:false
  selection_logman_img:
    - Image|endswith: \logman.exe
    - OriginalFileName: Logman.exe
  selection_logman_update:
    CommandLine|contains|all:
      - update
      - trace
      - --p
      - -ets
  selection_pwsh_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - powershell.exe
        - pwsh.dll
  selection_pwsh_cli:
    - CommandLine|contains: Remove-EtwTraceProvider
    - CommandLine|contains|all:
        - Set-EtwTraceProvider
        - "0x11"
    - CommandLine|contains|all:
        - Set-EtwTraceProvider
        - " 17"
    - CommandLine|contains|all:
        - Set-EtwTraceProvider
        - "'17'"
    - CommandLine|contains|all:
        - Set-EtwTraceProvider
        - '"17"'
  condition: |
    (selection_wevtutil_img and 1 of selection_wevtutil_cli_*)
    or (all of selection_logman_*)
    or (all of selection_pwsh_*)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a238b5d0-ce2d-4414-a676-7a531b3d13d6
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL