Merge pull request #1165 from w0rk3r/oscd3

[OSCD] Updated win_etw_trace_evasion - Added new detections, Removed reference to deprecated rule and changed selections

rules/windows/process_creation/win_etw_trace_evasion.yml

@@ -4,9 +4,9 @@ description: Detects a command that clears or disables any ETW trace log which c
 status: experimental
 references:
     - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
-    - https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_mal_lockergoga.yml
     - https://abuse.io/lockergoga.txt
-author: '@neu5ron, Florian Roth'
+    - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+author: '@neu5ron, Florian Roth, Jonhnathan Ribeiro, oscd.community'
 date: 2019/03/22
 tags:
     - attack.defense_evasion
@@ -19,13 +19,39 @@ logsource:
     product: windows
 detection:
     selection_clear_1:
-        CommandLine: '* cl */Trace*'
+        CommandLine|contains|all: 
+          - 'cl'
+          - '/Trace'
     selection_clear_2:
-        CommandLine: '* clear-log */Trace*'
+        CommandLine|contains|all: 
+          - 'clear-log'
+          - '/Trace'
     selection_disable_1:
-        CommandLine: '* sl* /e:false*'
+        CommandLine|contains|all: 
+          - 'sl'
+          - '/e:false'
     selection_disable_2:
-        CommandLine: '* set-log* /e:false*'
+        CommandLine|contains|all: 
-    condition: selection_clear_1 or selection_clear_2 or selection_disable_1 or selection_disable_2
+          - 'set-log'
+          - '/e:false'
+    selection_disable_3: #Autologger provider removal
+        Commandline|contains|all:
+          - 'Remove-EtwTraceProvider'
+          - 'EventLog-Microsoft-Windows-WMI-Activity-Trace'
+          - '{1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}'
+    selection_disable_4: #Provider “Enable” property modification
+        Commandline|contains|all:
+          - 'Set-EtwTraceProvider'
+          - '{1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}'
+          - 'EventLog-Microsoft-Windows-WMI-Activity-Trace'
+          - '0x11'
+    selection_disable_5: #ETW provider removal from a trace session
+        Commandline|contains|all:
+          - "logman" 
+          - "update" 
+          - "trace" 
+          - "--p"
+          - "-ets"
+    condition: 1 of them
 falsepositives:
     - Unknown