ETW Trace Evasion Activity

title: ETW Trace Evasion Activity
id: a238b5d0-ce2d-4414-a676-7a531b3d13d6
status: test
description: |
    Detects command line activity that attempts to tamper with Event Tracing for Windows (ETW) by clearing or disabling
    trace logs or providers. Adversaries may target ETW to blind security tooling and evade detection by removing
    visibility into process activity, network connections, and other telemetry sources.
    Techniques include clearing logs via wevtutil, disabling trace sessions via logman, and removing or modifying
    ETW providers using PowerShell cmdlets such as Remove-EtwTraceProvider and Set-EtwTraceProvider.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
    - https://abuse.io/lockergoga.txt
    - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
author: '@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community'
date: 2019-03-22
modified: 2026-10-12
tags:
    - attack.stealth
    - attack.defense-impairment
    - attack.t1070
    - attack.t1685
    - car.2016-04-002
logsource:
    category: process_creation
    product: windows
detection:
    selection_wevtutil_img:
        - Image|endswith: '\wevtutil.exe'
        - OriginalFileName: 'wevtutil.exe'
    selection_wevtutil_cli_clear:   # Example: wevtutil cl "/Trace" or wevtutil cl "Microsoft-Windows-DNS-Client/Operational"
        CommandLine|contains:
            - ' cl '
            - 'clear-log'
        CommandLine|contains|windash: '/Trace'
    selection_wevtutil_cli_disable:   # Example: wevtutil sl "Microsoft-Windows-DNS-Client/Operational" /e:false
        CommandLine|contains:
            - ' sl '
            - 'set-log'
        CommandLine|contains|windash: '/e:false'
    selection_logman_img:   # Example: logman update trace EventLog-Application --p "Microsoft-Windows-Security-Auditing" -ets
        - Image|endswith: '\logman.exe'
        - OriginalFileName: 'Logman.exe'
    selection_logman_update:   # Example: logman update trace EventLog-Application --p "Microsoft-Windows-Security-Auditing" -ets
        CommandLine|contains|all:
            - 'update'
            - 'trace'
            - '--p'
            - '-ets'
    selection_pwsh_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'powershell.exe'
              - 'pwsh.dll'
    selection_pwsh_cli:
        # Example: Remove-EtwTraceProvider -AutologgerName "EventLog-Application" -Guid "{54849625-5478-4994-A5BA-3E3B0328C30D}"
        - CommandLine|contains: 'Remove-EtwTraceProvider'
        # Example: Set-EtwTraceProvider -Guid '{A0C1853B-5C40-4B15-8766-3CF1C58F985A}' -AutologgerName 'EventLog-Application' -Property 0x11
        # Note: 0x11 and 17 are equivalent and represent the same property value
        - CommandLine|contains|all:
              - 'Set-EtwTraceProvider'
              - '0x11'
        - CommandLine|contains|all:
              - 'Set-EtwTraceProvider'
              - ' 17'
        - CommandLine|contains|all:
              - 'Set-EtwTraceProvider'
              - "'17'"
        - CommandLine|contains|all:
              - 'Set-EtwTraceProvider'
              - '"17"'
    condition: |
        (selection_wevtutil_img and 1 of selection_wevtutil_cli_*)
        or (all of selection_logman_*)
        or (all of selection_pwsh_*)
falsepositives:
    - Unknown
level: high