huntrule

Windows reg.exe disables Defender WMI Autologger sessions by setting Start to 0

Flags reg.exe changing WMI Autologger Start for DefenderApiLogger/DefenderAuditLogger to 0, impairing ETW security logging.

FreeUnreviewedSigmahighv1
title: Windows reg.exe disables Defender WMI Autologger sessions by setting Start to 0
id: 480be11a-26be-427a-b10c-16f59e25173b
related:
  - id: f37b4bce-49d0-4087-9f5b-58bffda77316
    type: similar
  - id: a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6
    type: derived
status: experimental
description: This rule identifies process executions of reg.exe that modify WMI Autologger Start values for the DefenderApiLogger and/or DefenderAuditLogger sessions to 0. Disabling these ETW Autologger sessions can stop security-relevant telemetry from being produced, weakening monitoring and detection relying on that event data. It relies on Windows process creation telemetry including Image/OriginalFileName and the full CommandLine containing the relevant WMI registry paths and the add operation setting Start to 0 (and excluding cases matching the specific filter token).
references:
  - https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/
  - https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
  - https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_disable_defender_wmi_autologger.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2025-07-09
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_reg_path:
    CommandLine|contains:
      - \Control\WMI\Autologger\DefenderApiLogger\Start
      - \Control\WMI\Autologger\DefenderAuditLogger\Start
  selection_reg_add:
    CommandLine|contains|all:
      - add
      - "0"
  filter_main_enable:
    CommandLine|contains: "0x00000001"
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Highly unlikely
level: high
license: DRL-1.1

What it detects

This rule identifies process executions of reg.exe that modify WMI Autologger Start values for the DefenderApiLogger and/or DefenderAuditLogger sessions to 0. Disabling these ETW Autologger sessions can stop security-relevant telemetry from being produced, weakening monitoring and detection relying on that event data. It relies on Windows process creation telemetry including Image/OriginalFileName and the full CommandLine containing the relevant WMI registry paths and the add operation setting Start to 0 (and excluding cases matching the specific filter token).

Known false positives

  • Highly unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.