Windows Process Creation: Registry Modification of WMI Autologger Sessions via reg or PowerShell

title: "Windows Process Creation: Registry Modification of WMI Autologger Sessions via reg or PowerShell"
id: d212edab-b9bf-4529-b2ca-16503d26484c
related:
  - id: f37b4bce-49d0-4087-9f5b-58bffda77316
    type: similar
  - id: d7b81144-b866-48a4-9bcc-275dc69d870e
    type: derived
status: experimental
description: This rule identifies process executions of reg.exe or PowerShell that include registry modification actions (add, Set-ItemProperty, New-ItemProperty) targeting the WMI Autologger configuration path. It further matches CommandLine content consistent with disabling specific autologger components by modifying keys such as Start and Enabled. Disabling autologger sessions can prevent collection of early-boot and system events, reducing visibility for security monitoring. Telemetry relies on Windows process creation logs containing Image/OriginalFileName and CommandLine substrings.
references:
  - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
  - https://ptylu.github.io/content/report/report.html?report=25
  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-25
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \reg.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - reg.exe
        - PowerShell.EXE
        - pwsh.dll
  selection_cli_action:
    CommandLine|contains:
      - "add "
      - Set-ItemProperty
      - New-ItemProperty
      - "si "
  selection_cli_base:
    CommandLine|contains: \Control\WMI\Autologger\
  selection_cli_key:
    CommandLine|contains:
      - Start
      - Enabled
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification/info.yml
simulation:
  - type: atomic-red-team
    name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd
    technique: T1562.001
    atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab
  - type: atomic-red-team
    name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
    technique: T1562.001
    atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c
  - type: atomic-red-team
    name: Disable EventLog-Application ETW Provider Via Registry - Cmd
    technique: T1562.001
    atomic_guid: 1cac9b54-810e-495c-8aac-989e0076583b
  - type: atomic-red-team
    name: Disable EventLog-Application ETW Provider Via Registry - PowerShell
    technique: T1562.001
    atomic_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0
license: DRL-1.1