An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting[1] or even disabling host-based sensors, such as Event Tracing for Windows (ETW)[2], by tampering settings that control the collection and flow of event telemetry.[3] These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such asPowerShell orWindows Management Instrumentation.
For example, adversaries may modify theFile value inHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security to hide their malicious actions in a new or different .evtx log file. This action does not require a system reboot and takes effect immediately.[4]
ETW interruption can be achieved multiple ways, however most directly by defining conditions using thePowerShellSet-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations.
In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis. This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products.
In Linux environments, adversaries may disable or reconfigure log processing tools such as syslog or nxlog to inhibit detection and monitoring capabilities to facilitate follow on behaviors.[5] ESXi also leverages syslog, which can be reconfigured via commands such asesxcli system syslog config set andesxcli system syslog config reload.[6][7]
| ID | Name | Description |
|---|---|---|
| G0096 | APT41 | APT41 developed a custom injector that enables an Event Tracing for Windows (ETW) bypass, making malicious processes invisible to Windows logging.[8] |
| G1023 | APT5 | APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to prevent certain log events from occurring.[9] |
| S1184 | BOLDMOVE | BOLDMOVE can disable the Fortinet daemons |
| S1063 | Brute Ratel C4 | Brute Ratel C4 has the ability to hide memory artifacts and to patch Event Tracing for Windows (ETW) and the Anti Malware Scan Interface (AMSI).[11][12] |
| S0377 | Ebury | Ebury hooks system functions to prevent the user from seeing malicious files ( |
| S0697 | HermeticWiper | HermeticWiper has the ability to set the |
| S1097 | HUI Loader | HUI Loader has the ability to disable Windows Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) functions.[18] |
| S1200 | StealBit | StealBit can configure processes to not display certain Windows error messages by through use of the |
| S0579 | Waterbear | Waterbear can hook the |
| S1065 | Woody RAT | Woody RAT has suppressed all error reporting by calling |
| ID | Mitigation | Description |
|---|---|---|
| M1022 | Restrict File and Directory Permissions | Ensure event tracers/forwarders[22], firewall policies, and other associated mechanisms are secured with appropriate permissions and access controls. |
| M1054 | Software Configuration | Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations. |
| M1018 | User Account Management | Ensure event tracers/forwarders[22], firewall policies, and other associated mechanisms are secured with appropriate permissions and access controls and cannot be manipulated by user accounts. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0239 | Detection Strategy for Impair Defenses Indicator Blocking | AN0667 | Correlates registry modifications to EventLog or WMI Autologger keys, suspicious use of Set-EtwTraceProvider, and Sysmon configuration changes. Defender sees interruption or redirection of ETW and log event collection. |
| AN0668 | Detects disabling or reconfiguration of syslog or rsyslog services. Monitors sudden stops in logging daemons and suspicious execution of kill or service stop commands targeting syslog processes. | ||
| AN0669 | Detection of tampering with Apple's Unified Logging framework or modification of system log forwarding settings. Defender observes execution of logd-related commands or defaults write to logging preferences. | ||
| AN0670 | Detection of syslog configuration tampering using esxcli system syslog config set or reload. Defender correlates command execution with absence of syslog forwarding activity. |