ETW Trace Evasion Activity

 1title: ETW Trace Evasion Activity
 2id: a238b5d0-ce2d-4414-a676-7a531b3d13d6
 3status: test
 4description: |
 5    Detects command line activity that attempts to tamper with Event Tracing for Windows (ETW) by clearing or disabling
 6    trace logs or providers. Adversaries may target ETW to blind security tooling and evade detection by removing
 7    visibility into process activity, network connections, and other telemetry sources.
 8    Techniques include clearing logs via wevtutil, disabling trace sessions via logman, and removing or modifying
 9    ETW providers using PowerShell cmdlets such as Remove-EtwTraceProvider and Set-EtwTraceProvider.    
10references:
11    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
12    - https://abuse.io/lockergoga.txt
13    - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
14author: '@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community'
15date: 2019-03-22
16modified: 2026-10-12
17tags:
18    - attack.stealth
19    - attack.defense-impairment
20    - attack.t1070
21    - attack.t1685
22    - car.2016-04-002
23logsource:
24    category: process_creation
25    product: windows
26detection:
27    selection_wevtutil_img:
28        - Image|endswith: '\wevtutil.exe'
29        - OriginalFileName: 'wevtutil.exe'
30    selection_wevtutil_cli_clear:   # Example: wevtutil cl "/Trace" or wevtutil cl "Microsoft-Windows-DNS-Client/Operational"
31        CommandLine|contains:
32            - ' cl '
33            - 'clear-log'
34        CommandLine|contains|windash: '/Trace'
35    selection_wevtutil_cli_disable:   # Example: wevtutil sl "Microsoft-Windows-DNS-Client/Operational" /e:false
36        CommandLine|contains:
37            - ' sl '
38            - 'set-log'
39        CommandLine|contains|windash: '/e:false'
40    selection_logman_img:   # Example: logman update trace EventLog-Application --p "Microsoft-Windows-Security-Auditing" -ets
41        - Image|endswith: '\logman.exe'
42        - OriginalFileName: 'Logman.exe'
43    selection_logman_update:   # Example: logman update trace EventLog-Application --p "Microsoft-Windows-Security-Auditing" -ets
44        CommandLine|contains|all:
45            - 'update'
46            - 'trace'
47            - '--p'
48            - '-ets'
49    selection_pwsh_img:
50        - Image|endswith:
51              - '\powershell.exe'
52              - '\pwsh.exe'
53        - OriginalFileName:
54              - 'powershell.exe'
55              - 'pwsh.dll'
56    selection_pwsh_cli:
57        # Example: Remove-EtwTraceProvider -AutologgerName "EventLog-Application" -Guid "{54849625-5478-4994-A5BA-3E3B0328C30D}"
58        - CommandLine|contains: 'Remove-EtwTraceProvider'
59        # Example: Set-EtwTraceProvider -Guid '{A0C1853B-5C40-4B15-8766-3CF1C58F985A}' -AutologgerName 'EventLog-Application' -Property 0x11
60        # Note: 0x11 and 17 are equivalent and represent the same property value
61        - CommandLine|contains|all:
62              - 'Set-EtwTraceProvider'
63              - '0x11'
64        - CommandLine|contains|all:
65              - 'Set-EtwTraceProvider'
66              - ' 17'
67        - CommandLine|contains|all:
68              - 'Set-EtwTraceProvider'
69              - "'17'"
70        - CommandLine|contains|all:
71              - 'Set-EtwTraceProvider'
72              - '"17"'
73    condition: |
74        (selection_wevtutil_img and 1 of selection_wevtutil_cli_*)
75        or (all of selection_logman_*)
76        or (all of selection_pwsh_*)        
77falsepositives:
78    - Unknown
79level: high