Windows reg.exe disables Defender WMI Autologger sessions by setting Start to 0
Flags reg.exe changing WMI Autologger Start for DefenderApiLogger/DefenderAuditLogger to 0, impairing ETW security logging.
- Product
- windows
- Category
- process_creation
- Author
- Matt Anderson (Huntress) (SigmaHQ), DRL 1.1
- Published
- 2025-07-09
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of reg.exe that modify WMI Autologger Start values for the DefenderApiLogger and/or DefenderAuditLogger sessions to 0. Disabling these ETW Autologger sessions can stop security-relevant telemetry from being produced, weakening monitoring and detection relying on that event data. It relies on Windows process creation telemetry including Image/OriginalFileName and the full CommandLine containing the relevant WMI registry paths and the add operation setting Start to 0 (and excluding cases matching the specific filter token).
Reporting behind it
- research.splunk.comhttps://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/
- docs.microsoft.comhttps://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
- thedfirreport.comhttps://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
- blog.malwarebytes.comhttps://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- binarly.iohttps://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_disable_defender_wmi_autologger.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows reg.exe disables Defender WMI Autologger sessions by setting Start to 0
id: 480be11a-26be-427a-b10c-16f59e25173b
related:
- id: f37b4bce-49d0-4087-9f5b-58bffda77316
type: similar
- id: a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6
type: derived
status: experimental
description: This rule identifies process executions of reg.exe that modify WMI Autologger Start values for the DefenderApiLogger and/or DefenderAuditLogger sessions to 0. Disabling these ETW Autologger sessions can stop security-relevant telemetry from being produced, weakening monitoring and detection relying on that event data. It relies on Windows process creation telemetry including Image/OriginalFileName and the full CommandLine containing the relevant WMI registry paths and the add operation setting Start to 0 (and excluding cases matching the specific filter token).
references:
- https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/
- https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_disable_defender_wmi_autologger.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2025-07-09
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \reg.exe
- OriginalFileName: reg.exe
selection_reg_path:
CommandLine|contains:
- \Control\WMI\Autologger\DefenderApiLogger\Start
- \Control\WMI\Autologger\DefenderAuditLogger\Start
selection_reg_add:
CommandLine|contains|all:
- add
- "0"
filter_main_enable:
CommandLine|contains: "0x00000001"
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Highly unlikely
level: high
license: DRL-1.1