Windows Registry AutoLogger Session Disable/Start Tampering via Event Log Targets

title: Windows Registry AutoLogger Session Disable/Start Tampering via Event Log Targets
id: 16465497-bbe8-4b53-9161-9d792be0840f
related:
  - id: d7b81144-b866-48a4-9bcc-275dc69d870e
    type: similar
  - id: f37b4bce-49d0-4087-9f5b-58bffda77316
    type: derived
status: test
description: This rule flags Windows Registry changes that modify AutoLogger-related session configuration under the Control\WMI\Autologger path. It specifically matches TargetObject values for EventLog-* and Defender logger entries whose Enabled or Start values are set to DWORD 0x00000000, indicating sessions are being disabled or not started. Attackers can use this to impair early-boot telemetry and reduce visibility into system and security-relevant activity. The detection relies on registry_set telemetry and filters out common wevtutil and Microsoft Defender platform binaries to reduce false positives.
references:
  - https://twitter.com/MichalKoczwara/status/1553634816016498688
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf
  - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_autologger_sessions.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-01
modified: 2025-12-26
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_main:
    TargetObject|contains: \Control\WMI\Autologger\
  selection_values:
    TargetObject|contains:
      - \EventLog-
      - \Defender
    TargetObject|endswith:
      - \Enabled
      - \Start
    Details: DWORD (0x00000000)
  filter_main_wevtutil:
    Image: C:\Windows\system32\wevtutil.exe
  filter_main_defender:
    Image|startswith:
      - C:\ProgramData\Microsoft\Windows Defender\Platform\
      - C:\Program Files\Windows Defender\
      - C:\Program Files (x86)\Windows Defender\
    Image|endswith: \MsMpEng.exe
    TargetObject|contains:
      - \DefenderApiLogger\
      - \DefenderAuditLogger\
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_autologger_sessions/info.yml
simulation:
  - type: atomic-red-team
    name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd
    technique: T1562.001
    atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab
  - type: atomic-red-team
    name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
    technique: T1562.001
    atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c
  - type: atomic-red-team
    name: Disable EventLog-Application ETW Provider Via Registry - Cmd
    technique: T1562.001
    atomic_guid: 1cac9b54-810e-495c-8aac-989e0076583b
  - type: atomic-red-team
    name: Disable EventLog-Application ETW Provider Via Registry - PowerShell
    technique: T1562.001
    atomic_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0
license: DRL-1.1