Sigma rule: ETW Trace Evasion Activity

Rule

Title

ETW Trace Evasion Activity

Status

test

Level

high

Author

@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community

Date

2019-03-22

Modified

2026-10-12

File

rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects command line activity that attempts to tamper with Event Tracing for Windows (ETW) by clearing or disabling
trace logs or providers. Adversaries may target ETW to blind security tooling and evade detection by removing
visibility into process activity, network connections, and other telemetry sources.
Techniques include clearing logs via wevtutil, disabling trace sessions via logman, and removing or modifying
ETW providers using PowerShell cmdlets such as Remove-EtwTraceProvider and Set-EtwTraceProvider.

Log source

product

windows

category

process_creation

Detection

selection_wevtutil_img:
    - Image|endswith: '\wevtutil.exe'
    - OriginalFileName: 'wevtutil.exe'
selection_wevtutil_cli_clear:   # Example: wevtutil cl "/Trace" or wevtutil cl "Microsoft-Windows-DNS-Client/Operational"
    CommandLine|contains:
        - ' cl '
        - 'clear-log'
    CommandLine|contains|windash: '/Trace'
selection_wevtutil_cli_disable:   # Example: wevtutil sl "Microsoft-Windows-DNS-Client/Operational" /e:false
    CommandLine|contains:
        - ' sl '
        - 'set-log'
    CommandLine|contains|windash: '/e:false'
selection_logman_img:   # Example: logman update trace EventLog-Application --p "Microsoft-Windows-Security-Auditing" -ets
    - Image|endswith: '\logman.exe'
    - OriginalFileName: 'Logman.exe'
selection_logman_update:   # Example: logman update trace EventLog-Application --p "Microsoft-Windows-Security-Auditing" -ets
    CommandLine|contains|all:
        - 'update'
        - 'trace'
        - '--p'
        - '-ets'
selection_pwsh_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'powershell.exe'
          - 'pwsh.dll'
selection_pwsh_cli:
    # Example: Remove-EtwTraceProvider -AutologgerName "EventLog-Application" -Guid "{54849625-5478-4994-A5BA-3E3B0328C30D}"
    - CommandLine|contains: 'Remove-EtwTraceProvider'
    # Example: Set-EtwTraceProvider -Guid '{A0C1853B-5C40-4B15-8766-3CF1C58F985A}' -AutologgerName 'EventLog-Application' -Property 0x11
    # Note: 0x11 and 17 are equivalent and represent the same property value
    - CommandLine|contains|all:
          - 'Set-EtwTraceProvider'
          - '0x11'
    - CommandLine|contains|all:
          - 'Set-EtwTraceProvider'
          - ' 17'
    - CommandLine|contains|all:
          - 'Set-EtwTraceProvider'
          - "'17'"
    - CommandLine|contains|all:
          - 'Set-EtwTraceProvider'
          - '"17"'
condition: |
    (selection_wevtutil_img and 1 of selection_wevtutil_cli_*)
    or (all of selection_logman_*)
    or (all of selection_pwsh_*)

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.defense-impairment
• attack.t1070
• attack.t1685
• car.2016-04-002

MITRE ATT&CK ids this rule names

• T1070
• T1685

References

• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
• https://abuse.io/lockergoga.txt
• https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml