huntrule

Windows Process Creation: ETW Trace Evasion via wevtutil, logman, and PowerShell

Identifies command-line attempts to clear/disable ETW traces or remove/modify ETW providers on Windows.

FreeReviewedSigma · High · v3
Product
windows
Category
process_creation
Author
@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
Published
2019-03-22
Updated
2026-10-13
AnalysisDetection
title: "Windows Process Creation: ETW Trace Evasion via wevtutil, logman, and PowerShell"
id: 07dc3a95-f701-4070-b932-dfdddaed436d
status: test
description: This rule identifies Windows process executions where attackers attempt to impair Event Tracing for Windows (ETW) by clearing event trace logs, disabling trace sessions, or removing/modifying ETW providers. Such actions can reduce telemetry coverage and blind security tooling by limiting visibility into system and application activity. Detection relies on process creation telemetry capturing the executable image and command-line arguments for wevtutil, logman, and PowerShell cmdlets like Remove-EtwTraceProvider and Set-EtwTraceProvider.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
  - https://abuse.io/lockergoga.txt
  - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml
author: "@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team"
date: 2019-03-22
modified: 2026-10-12
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1070
  - attack.t1685
  - car.2016-04-002
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil_img:
    - Image|endswith: \wevtutil.exe
    - OriginalFileName: wevtutil.exe
  selection_wevtutil_cli_clear:
    CommandLine|contains:
      - " cl "
      - clear-log
    CommandLine|contains|windash: /Trace
  selection_wevtutil_cli_disable:
    CommandLine|contains:
      - " sl "
      - set-log
    CommandLine|contains|windash: /e:false
  selection_logman_img:
    - Image|endswith: \logman.exe
    - OriginalFileName: Logman.exe
  selection_logman_update:
    CommandLine|contains|all:
      - update
      - trace
      - --p
      - -ets
  selection_pwsh_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - powershell.exe
        - pwsh.dll
  selection_pwsh_cli:
    - CommandLine|contains: Remove-EtwTraceProvider
    - CommandLine|contains|all:
        - Set-EtwTraceProvider
        - "0x11"
    - CommandLine|contains|all:
        - Set-EtwTraceProvider
        - " 17"
    - CommandLine|contains|all:
        - Set-EtwTraceProvider
        - "'17'"
    - CommandLine|contains|all:
        - Set-EtwTraceProvider
        - '"17"'
  condition: |
    (selection_wevtutil_img and 1 of selection_wevtutil_cli_*)
    or (all of selection_logman_*)
    or (all of selection_pwsh_*)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a238b5d0-ce2d-4414-a676-7a531b3d13d6
    type: derived