Disabling Windows Defender WMI Autologger Session via Reg.exe

Matt Anderson (Huntress)

Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.

2025-07-09 00:00:00

None

a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6

attack.defense-evasion attack.t1562.001

Community Rule

Matt Anderson

Merge PR #5528 from @MATTANDERS0N - add rules for defense evasion

2025-07-28