ETW Logging Disabled For SCM

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects attempts to disable Event Tracing for Windows (ETW) logging specifically for the Service Control Manager (SCM) by modifying the 'TracingDisabled' registry key. Adversaries may do this to impair defensive capabilities and hide their activities, as ETW logs are crucial for security monitoring and incident response.