Windows Process Creation: Registry Modification to Disable ETW AutoLogger via reg.exe or PowerShell

Flags reg.exe or PowerShell registry changes aimed at disabling WMI AutoLogger EventLog session components.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-12-25
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process executions where reg.exe or PowerShell commands modify registry values under the AutoLogger WMI path, including keys used to disable specific autologger sessions/providers (e.g., Start and Enabled). Disabling AutoLogger can suppress early-boot event tracing, reducing visibility into system activity before a user logs in. The detection relies on Windows process creation telemetry, matching command-line patterns for registry modification actions and the AutoLogger control path.

Reporting behind it

Related detections9 linkedT1685.001 — drag to rearrange

Malicious Security Event Log Disabled via wevtutil

Malicious SQL Server Auditing Deactivated (via application)

Malicious Event Log Deactivation or Size Reduction - Command (via process_creation)

Malicious Audit Policy Disabled by Command Line (via process_creation)

Suspicious IIS Logging Disabled via appcmd

Malicious SQL Server Database Auditing Deactivated (via application)

Malicious Audit Policy Disabled by Command Line (via security)

Malicious Event Log Tampering via wevtutil Channel Disable by FunkSec Ransomware (via process_creation)

OCSP Responder Auditing Settings Changed or Disabled (via security)

Windows Process Creation: Registry Modification to Disable ETW AutoLogger via reg.exe or PowerShell

Pivot detection · T1685.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-registry-modification-of-wmi-autologger-sessions-via-re-d7b81144

title: "Windows Process Creation: Registry Modification to Disable ETW AutoLogger via reg.exe or PowerShell"
id: d212edab-b9bf-4529-b2ca-16503d26484c
related:
  - id: f37b4bce-49d0-4087-9f5b-58bffda77316
    type: similar
  - id: d7b81144-b866-48a4-9bcc-275dc69d870e
    type: derived
status: experimental
description: This rule identifies process executions where reg.exe or PowerShell commands modify registry values under the AutoLogger WMI path, including keys used to disable specific autologger sessions/providers (e.g., Start and Enabled). Disabling AutoLogger can suppress early-boot event tracing, reducing visibility into system activity before a user logs in. The detection relies on Windows process creation telemetry, matching command-line patterns for registry modification actions and the AutoLogger control path.
references:
  - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
  - https://ptylu.github.io/content/report/report.html?report=25
  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-25
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \reg.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - reg.exe
        - PowerShell.EXE
        - pwsh.dll
  selection_cli_action:
    CommandLine|contains:
      - "add "
      - Set-ItemProperty
      - New-ItemProperty
      - "si "
  selection_cli_base:
    CommandLine|contains: \Control\WMI\Autologger\
  selection_cli_key:
    CommandLine|contains:
      - Start
      - Enabled
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification/info.yml
simulation:
  - type: atomic-red-team
    name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd
    technique: T1562.001
    atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab
  - type: atomic-red-team
    name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
    technique: T1562.001
    atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c
  - type: atomic-red-team
    name: Disable EventLog-Application ETW Provider Via Registry - Cmd
    technique: T1562.001
    atomic_guid: 1cac9b54-810e-495c-8aac-989e0076583b
  - type: atomic-red-team
    name: Disable EventLog-Application ETW Provider Via Registry - PowerShell
    technique: T1562.001
    atomic_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL