Hub configuration

Name: ETW Logging Tamper In .NET Processes Via CommandLine
Author: sigmahq

More info

ETW Logging Tamper In .NET Processes Via CommandLine Detection Scenario by sigmahq | CrowdSec Hub

« ETW Logging Tamper In .NET Processes Via CommandLine »
v0.2 by sigmahq / proc_creation_win_susp_etw_modification_cmdline
Attack scenariowindowsNot spoofableLow confidence

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

Installation

cscli scenarios install sigmahq/proc_creation_win_susp_etw_modification_cmdline

YAML Configuration

1type: trigger
2name: sigmahq/proc_creation_win_susp_etw_modification_cmdline
3description: |
4  Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies. 
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains 'COMPlus_ETWEnabled' || evt.Parsed.CommandLine contains 'COMPlus_ETWFlags')
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1562
15
16  label: "ETW Logging Tamper In .NET Processes Via CommandLine"
17  behavior : "windows:audit"
18  remediation: false
19
20scope:
21  type: ParentProcessId
22  expression: evt.Parsed.ParentProcessId
23
24

Hub configuration

« ETW Logging Tamper In .NET Processes Via CommandLine »v0.2 by sigmahq / proc_creation_win_susp_etw_modification_cmdlineAttack scenariowindowsNot spoofableLow confidenceMITRE:t1562

« ETW Logging Tamper In .NET Processes Via CommandLine »
v0.2 by sigmahq / proc_creation_win_susp_etw_modification_cmdline
Attack scenariowindowsNot spoofableLow confidence