cscli scenarios install sigmahq/proc_creation_win_susp_etw_trace_evasion1type: trigger2name: sigmahq/proc_creation_win_susp_etw_trace_evasion3description: |4 Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains 'cl' && evt.Parsed.CommandLine contains '/Trace' || evt.Parsed.CommandLine contains 'clear-log' && evt.Parsed.CommandLine contains '/Trace' || evt.Parsed.CommandLine contains 'sl' && evt.Parsed.CommandLine contains '/e:false' || evt.Parsed.CommandLine contains 'set-log' && evt.Parsed.CommandLine contains '/e:false' || evt.Parsed.CommandLine contains 'logman' && evt.Parsed.CommandLine contains 'update' && evt.Parsed.CommandLine contains 'trace' && evt.Parsed.CommandLine contains '--p' && evt.Parsed.CommandLine contains '-ets' || evt.Parsed.CommandLine contains 'Remove-EtwTraceProvider' || evt.Parsed.CommandLine contains 'Set-EtwTraceProvider' && evt.Parsed.CommandLine contains '0x11')7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t107015 - attack.t1562.0061617 label: "ETW Trace Evasion Activity"18 behavior : "windows:audit"19 remediation: false2021scope:22 type: ParentProcessId23 expression: evt.Parsed.ParentProcessId2425