Disable of ETW Trace - Powershell

Title: Disable of ETW Trace - Powershell
Status: test
Description:Detects usage of powershell cmdlets to disable or remove ETW trace sessions
References:
  -https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-28
modified:2022-11-25
Tags:

• -'attack.stealth'
• -'attack.defense-impairment'
• -'attack.t1070'
• -'attack.t1685'
• -'car.2016-04-002'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_pwsh_remove:
    ScriptBlockText|contains: 'Remove-EtwTraceProvider '
  selection_pwsh_set:
    ScriptBlockText|contains|all:
      -'Set-EtwTraceProvider '
      -'0x11'

  condition:1 of selection*
Falsepositives:
  -Unknown
Level: high