name: Disable ETW Through Registry
id: f0eacfa4-d33f-11eb-8f9d-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: this search is to identify modification in registry to disable ETW windows
  feature to evade detections. This technique was seen in several ransomware, RAT
  and even APT to impaire defenses of the compromise machine and to be able to execute
  payload with minimal alert as much as possible.
data_source:
- Sysmon Event ID 13
search:
  selection1:
    Details: '0x00000000'
    TargetObject: '*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled'
  condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
  that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: network operator may disable this feature of windows but not
  so common.
references:
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
tags:
  analytic_story:
  - Ransomware
  - Windows Registry Abuse
  asset_type: Endpoint
  confidence: 50
  impact: 50
  message: Disable ETW Through Registry
  mitre_attack_id:
  - T1562.001
  - T1562
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 25.0
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog