Sagan high stable other

[WINDOWS-SYSMON] Backstab Registry ETW Provider Modification

[WINDOWS-SYSMON] Backstab Registry ETW Provider Modification

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Backstab Registry ETW Provider Modification"; program:*Sysmon*; event_id:12,13; content:"EventType: setValue"; content:"TargetObject"; content:"SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger"; nocase; content:"Microsoft-Windows-Kernel-EventTracing"; nocase; distance:0; within:200; classtype:suspicious-command; reference:url,github.com/Yaxser/Backstab; sid:5015966; rev:1; metadata:created_at 2025_05_23, mitre_tactic_id TA0005, mitre_technique_id T1562.006;)

Field Validations

Loading…

Comments (0)

Loading comments...