Windows Process Creation: Registry Modification to Disable ETW AutoLogger via reg.exe or PowerShell
Flags reg.exe or PowerShell registry changes aimed at disabling WMI AutoLogger EventLog session components.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-12-25
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions where reg.exe or PowerShell commands modify registry values under the AutoLogger WMI path, including keys used to disable specific autologger sessions/providers (e.g., Start and Enabled). Disabling AutoLogger can suppress early-boot event tracing, reducing visibility into system activity before a user logs in. The detection relies on Windows process creation telemetry, matching command-line patterns for registry modification actions and the AutoLogger control path.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
- ptylu.github.iohttps://ptylu.github.io/content/report/report.html?report=25
- blog.palantir.comhttps://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-registry-modification-of-wmi-autologger-sessions-via-re-d7b81144
title: "Windows Process Creation: Registry Modification to Disable ETW AutoLogger via reg.exe or PowerShell"
id: d212edab-b9bf-4529-b2ca-16503d26484c
related:
- id: f37b4bce-49d0-4087-9f5b-58bffda77316
type: similar
- id: d7b81144-b866-48a4-9bcc-275dc69d870e
type: derived
status: experimental
description: This rule identifies process executions where reg.exe or PowerShell commands modify registry values under the AutoLogger WMI path, including keys used to disable specific autologger sessions/providers (e.g., Start and Enabled). Disabling AutoLogger can suppress early-boot event tracing, reducing visibility into system activity before a user logs in. The detection relies on Windows process creation telemetry, matching command-line patterns for registry modification actions and the AutoLogger control path.
references:
- https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
- https://ptylu.github.io/content/report/report.html?report=25
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-25
tags:
- attack.defense-impairment
- attack.t1685.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \reg.exe
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- reg.exe
- PowerShell.EXE
- pwsh.dll
selection_cli_action:
CommandLine|contains:
- "add "
- Set-ItemProperty
- New-ItemProperty
- "si "
selection_cli_base:
CommandLine|contains: \Control\WMI\Autologger\
selection_cli_key:
CommandLine|contains:
- Start
- Enabled
condition: all of selection_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification/info.yml
simulation:
- type: atomic-red-team
name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd
technique: T1562.001
atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab
- type: atomic-red-team
name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
technique: T1562.001
atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c
- type: atomic-red-team
name: Disable EventLog-Application ETW Provider Via Registry - Cmd
technique: T1562.001
atomic_guid: 1cac9b54-810e-495c-8aac-989e0076583b
- type: atomic-red-team
name: Disable EventLog-Application ETW Provider Via Registry - PowerShell
technique: T1562.001
atomic_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0
license: DRL-1.1