Windows Registry AutoLogger Session Disable/Start Tampering via Event Log Targets

Alerts when registry changes disable or stop AutoLogger sessions for EventLog-* or Defender by setting Enabled/Start to 0x0.

FreeReviewedSigma · High · v1

Product: windows
Category: registry_set
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-08-01
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Registry changes that modify AutoLogger-related session configuration under the Control\WMI\Autologger path. It specifically matches TargetObject values for EventLog-* and Defender logger entries whose Enabled or Start values are set to DWORD 0x00000000, indicating sessions are being disabled or not started. Attackers can use this to impair early-boot telemetry and reduce visibility into system and security-relevant activity. The detection relies on registry_set telemetry and filters out common wevtutil and Microsoft Defender platform binaries to reduce false positives.

Reporting behind it

Related detections9 linkedT1685.001 — drag to rearrange

Malicious Security Event Log Disabled via wevtutil

Malicious SQL Server Auditing Deactivated (via application)

Malicious Event Log Deactivation or Size Reduction - Command (via process_creation)

Malicious Audit Policy Disabled by Command Line (via process_creation)

Suspicious IIS Logging Disabled via appcmd

Malicious SQL Server Database Auditing Deactivated (via application)

Malicious Audit Policy Disabled by Command Line (via security)

Malicious Event Log Tampering via wevtutil Channel Disable by FunkSec Ransomware (via process_creation)

OCSP Responder Auditing Settings Changed or Disabled (via security)

Windows Registry AutoLogger Session Disable/Start Tampering via Event Log Targets

Pivot detection · T1685.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-autologger-session-disable-start-tampering-via-event-log-target-f37b4bce

title: Windows Registry AutoLogger Session Disable/Start Tampering via Event Log Targets
id: 16465497-bbe8-4b53-9161-9d792be0840f
related:
  - id: d7b81144-b866-48a4-9bcc-275dc69d870e
    type: similar
  - id: f37b4bce-49d0-4087-9f5b-58bffda77316
    type: derived
status: test
description: This rule flags Windows Registry changes that modify AutoLogger-related session configuration under the Control\WMI\Autologger path. It specifically matches TargetObject values for EventLog-* and Defender logger entries whose Enabled or Start values are set to DWORD 0x00000000, indicating sessions are being disabled or not started. Attackers can use this to impair early-boot telemetry and reduce visibility into system and security-relevant activity. The detection relies on registry_set telemetry and filters out common wevtutil and Microsoft Defender platform binaries to reduce false positives.
references:
  - https://twitter.com/MichalKoczwara/status/1553634816016498688
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf
  - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_autologger_sessions.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-01
modified: 2025-12-26
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_main:
    TargetObject|contains: \Control\WMI\Autologger\
  selection_values:
    TargetObject|contains:
      - \EventLog-
      - \Defender
    TargetObject|endswith:
      - \Enabled
      - \Start
    Details: DWORD (0x00000000)
  filter_main_wevtutil:
    Image: C:\Windows\system32\wevtutil.exe
  filter_main_defender:
    Image|startswith:
      - C:\ProgramData\Microsoft\Windows Defender\Platform\
      - C:\Program Files\Windows Defender\
      - C:\Program Files (x86)\Windows Defender\
    Image|endswith: \MsMpEng.exe
    TargetObject|contains:
      - \DefenderApiLogger\
      - \DefenderAuditLogger\
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_autologger_sessions/info.yml
simulation:
  - type: atomic-red-team
    name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd
    technique: T1562.001
    atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab
  - type: atomic-red-team
    name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
    technique: T1562.001
    atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c
  - type: atomic-red-team
    name: Disable EventLog-Application ETW Provider Via Registry - Cmd
    technique: T1562.001
    atomic_guid: 1cac9b54-810e-495c-8aac-989e0076583b
  - type: atomic-red-team
    name: Disable EventLog-Application ETW Provider Via Registry - PowerShell
    technique: T1562.001
    atomic_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL