Windows Defender: WMI Autologger session tampering via Reg.exe

This technique involves the modification of Windows Registry keys related to the Event Tracing for Windows (ETW) Autologger sessions specifically for 'DefenderApiLogger' and 'DefenderAuditLogger'. By setting the 'Start' registry value to '0' via the command line, attackers can silence the logging of critical Defender security events. This action impairs the visibility of security operations centers and endpoint detection and response (EDR) platforms that rely on ETW telemetry for threat detection.

Impact

Successful execution of this technique prevents the generation of Defender API and Audit event logs, creating a blind spot in host-based monitoring. This allows attackers to perform further malicious actions without triggering detection mechanisms that depend on these specific event sources.

Recommendation

• Deploy the provided Sigma rule to detect the use of 'reg.exe' for modifying Autologger start values.
• Baseline administrative registry modifications in your environment to distinguish legitimate system configuration from adversarial activity.
• Investigate any 'reg.exe' processes executing commands that target registry paths under 'Control\WMI\Autologger'.