Suspicious Windows Trace ETW Session Tamper Via Logman.EXE

About the rule

Rule Type

Standard

Rule Description

Detects the execution of ""logman"" utility in order to disable or delete Windows trace sessions

Severity

Trouble

Rule journey

Attack chain scenario

Initial access → Privilege escalation → Reconnaissance phase → ETW tampering → Log deletion → Stealth persistence

Impact

• Logging evasion
• Audit disruption
• Stealth operations
• Forensic obstruction

Rule Requirement

Prerequisites

• Using Windows event viewer:

To enable detailed process tracking, log in to the domain controller with domain admin credentials and open the Group Policy Management Console (GPMC). Create or modify a GPO linked to the relevant OU and navigate to the Detailed Tracking section under Audit Policies. Enable Audit Process Creation and Audit Process Termination by selecting the Success checkbox in each setting. For deeper visibility, enable command line logging by setting "Include command line in process creation events" to Enabled. Additionally, ensure the registry key Microsoft-Windows-Security-Auditing/Operational exists under the EventLog directory.

• Using Sysmon:

Download and install Sysmon from Microsoft Sysinternals, and run it with administrator privileges using a configuration file that enables process creation monitoring. Install Sysmon with the command sysmon.exe -i [configfile.xml], and ensure your config captures all process creation events. Finally, create the registry key Microsoft-Windows-Sysmon/Operational under the EventLog directory if it doesn’t already exist.

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

• Defense Evasion: Indicator Removal - Clear Windows Event Logs (T1070.001)
• Defense Evasion: Impair Defenses - Disable or Modify Tools (T1562.001)

Security Standards

Enabling this rule will help you meet the security standard's requirements listed below:

• SI-4: System Monitoring
  Ensure continuous monitoring to detect attacks and indicators of compromise.
  Triggering this rule helps identify attempts to disable logging, ensuring critical monitoring mechanisms remain active.
• AU-6: Audit Review, Analysis, and Reporting
  Mandates timely review and analysis of audit records for indications of inappropriate or unusual activity.
  Triggering this rule highlights potential tampering with audit mechanisms, supporting deeper review and correlation.
• AU-12: Audit Generation
  Requires systems to generate audit records for defined events.
  Triggering this rule detects actions that could prevent audit generation, maintaining logging integrity.
• SI-7: Software, Firmware, and Information Integrity
  Ensures the integrity of security functions, including logs and monitoring tools.
  Triggering this rule alerts on modifications that could degrade system integrity, such as disabling trace sessions.
• IR-5: Incident Monitoring
  Supports detection of security incidents through event and incident data collection.
  Triggering this rule provides visibility into tampering that may precede or follow an incident.
• AU-14: Session Audit
  Ensures mechanisms are in place to monitor session activity and record relevant audit data.
  Triggering this rule detects attempts to stop session-level trace logging, safeguarding audit coverage.

Author

Florian Roth (Nextron Systems)

Future actions

Known False Positives

This rule will be triggered when administrative staff legitimately deactivate services for maintenance or configuration purposes.

Next Steps

When this rule is triggered, the following measures can be implemented:

1. Identification: Identify if the flagged event is a new incident or part of an existing incident.
2. Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
3. Response: Respond promptly by initiating an automated workflow to interrupt the network connections and cease the malicious process.

• Containment: Isolate the affected host to prevent further disruption of monitoring services or potential lateral movement.
• Recovery: Re-enable or recreate the tampered ETW trace sessions and restore logging configurations to resume normal auditing.

Mitigation