impair defenses | indicator blocking | ETW - event tracing for windows | autologger | wmi

https://attack.mitre.org/techniques/T1562/006/ 

https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63

 

synopsis:

Attacker always wants to cover their tracks. so they delete or disable windows event logs, audit logs, they even interrupt logging system or agent from the host so the host cannot send their logs to siem. 

attacker may change the following registry to achieve that:

HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AUTOLOGGER_NAME\{Provider_GUID}

it can also be done by utilizing some administrative utilities like powershell, windows management instrumentation etc. 

now the question is how can we know the autologger name, GUID etc?

you can know that by navigating to the above registry path. or we can dig deeper the followings:

ETW architecture:

events providers

event tracing sessions

event consumers

 

tracing sessions are responsible for collecting events from event providers and relaying them to log files and consumers. sessions are created and configured by controllers like the windows built-in logman.exe command line utility. now we will see some existing commands for exploring existing trace sessions and their respective ETW providers. note that, need to execute these commands with elevated context. 

list all running trace sessions:

logman query -ets

 data collector set which we call autologger name / ETW provider. 

 

list all providers that a trace session is subscribed to:

logman query "EventLog-Application" -ets

you will get the GUID besides the provider name. 

 

ETW tempering techniques:

ETW provides a stealthy mechanism to affect logging without itself generating an event log trail. here is the log supply cut off procedure--

1. you can alter the registry setting. change the start value from 1 to 0. 

no need to reboot this is called ephemeral. where the attack can take place without a reboot. 

2. attacker can delete the whole registry

HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AUTOLOGGER_NAME{PROVIDER_GUID}

the above techniques involves the removal of a provider entry from a configured autologger. removing a provider registration from an autologger will cause events to cease the flow to the respective trace session.

i.e. Remove-EtwTraceProvider -AutologgerName EventLog-Application -Guid '{A0C1853B-5C40-4B15-8766-3CF1C58F985A}'

THE ABOVE EXAMPLE, the guid refers to the Microsoft-Windows-PowerShell ETW provider. this command will end up deleting the following registry key:

HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{A0C1853B-5C40-4B15-8766-3CF1C58F985A} 

 

3. Provider enable property modificaition:

HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AUTOLOGGER_NAME{PROVIDER_GUID} - EnableProperty (REG_DWORD)

this technique involves altering the Enable keyword of an autologger session. for example, by default all ETW provider entries in the EventLog-Application autologger session are set to 0x41 which translates to

EVENT_ENABLE_PROPERTY_SID and  EVENT_ENABLE_PROPERTY_ENABLE_KEYWORD_0.

EVENT_ENABLE_PROPERTY_ENABLE_KEYWORD_0 is not documented. it specifies that any events generated for a provider should be logged even if the keyword value is set to 0. so what attacker can do is, EVENT_ENABLE_PROPERTY_IGNORE_KEYWORD_0 which resulting value 0x11 which further specifies all events where the vaule is 0 and ignore, those not to be logged. 

example:

Set-EtwTraceProvider -Guid '{A0C1853B-5C40-4B15-8766-3CF1C58F985A}' -AutologgerName EventLog-Application -Property 0x11

the guid is for Microsoft-Windows-PowerShell event logging.

the above example will end up setting:

HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{A0C1853B-5C40-4B15-8766-3CF1C58F985A}\EnableProperty to 0x11

upon rebooting events will cease to be reported to the powershell event log. 

 

standard Logging level:

0 log always

1 log critical

2 error

3 warning

4 informational

5 verbose 

 

4. ETW provider removal from a trace session

tempering category: ephemeral

permission required: system

detection artifacts: unfortunately no file, registry, event logs are associated with this event. logman.exe will be issued to perform this attack. an attacker can obfuscate their techniques by using win32 api directly, wmi, dcom, powershell etc. 

the techniques involves removing an ETW provider from a trace session, cutting off its ability to supply events to log file or consumer until a reboot occurs or until the attacker restores the ETW provider. 

here is the following powershell code that attacker can apply:

logman update trace EventLog-Application --p Microsoft-PowerShell -ets

 

Splunk:

check event id 8 and 12 for detection.  

check image or process logman.exe or Image="*\\logman.exe" or Image="*\\wpr.exe"

CommandLine="*query*" or CommandLine="*update trace*"

TargetObject=”HKLM\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger*” 

https://securebug.se/blog/category/detection-rules/

https://gist.github.com/guitarrapc/35a94b908bad677a7310

 

 

 

 attacker can change the start value as 0 instead of 1. 

but a user with non-admin privileges can not even view the permission of this registry. 

permissions should be Administrators, EventLog and SYSTEM