ETW Trace Evasion Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects command line activity that attempts to clear or disable Event Tracing for Windows (ETW) trace logs. This behavior is indicative of logging evasion, where an attacker tries to remove or prevent the collection of forensic evidence.