Windows Registry Change Disables ETW for rpcrt4.dll via ExtErrorInformation

title: Windows Registry Change Disables ETW for rpcrt4.dll via ExtErrorInformation
id: f64fa190-d79a-44e5-913f-8644856b9e7b
status: test
description: This rule identifies modifications to the ExtErrorInformation registry value under the Microsoft\Windows NT\Rpc path for rpcrt4.dll and matches configurations that turn ETW off (0x00000000 or 0x00000002). Disabling or weakening ETW logging can help attackers reduce visibility into process, error, or RPC-related activity. The detection relies on registry set telemetry that reports the target key path and the DWORD value written.
references:
  - http://redplait.blogspot.com/2020/07/whats-wrong-with-etw.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_rpcrt4_etw_tamper.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-09
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
  - attack.t1685
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: \Microsoft\Windows NT\Rpc\ExtErrorInformation
    Details:
      - DWORD (0x00000000)
      - DWORD (0x00000002)
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 90f342e1-1aaa-4e43-b092-39fda57ed11e
    type: derived