Detect Indicator Blocking in IBM QRadar
Adversaries may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This includes tampering with Event Tracing for Windows (ETW), disabling crash dumps, modifying syslog configuration, redirecting telemetry, or blocking network traffic to SIEM/logging infrastructure. ETW tampering is particularly impactful as many security tools depend on ETW providers for visibility.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Sub-technique
- T1562.006 Indicator Blocking
- Canonical reference
- https://attack.mitre.org/techniques/T1562/006/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip,
username,
LOGSOURCENAME(logsourceid) AS log_source,
QIDNAME(qid) AS event_name,
"CommandLine",
"TargetObject",
CASE
WHEN "CommandLine" ILIKE '%Set-EtwTraceProvider%'
OR "CommandLine" ILIKE '%Remove-EtwTraceProvider%'
OR "CommandLine" ILIKE '%logman stop%'
OR "CommandLine" ILIKE '%logman delete%'
OR "CommandLine" ILIKE '%logman update%'
THEN 'ETW Tampering'
WHEN "CommandLine" ILIKE '%EtwEventWrite%'
OR "CommandLine" ILIKE '%NtTraceEvent%'
OR "CommandLine" ILIKE '%NtTraceControl%'
THEN 'ETW API Patching'
WHEN "CommandLine" ILIKE '%CrashDumpEnabled%'
OR "TargetObject" ILIKE '%CrashControl%'
THEN 'Crash Dump Disabled'
WHEN "CommandLine" ILIKE '%rsyslog%'
OR "CommandLine" ILIKE '%syslog-ng%'
OR "CommandLine" ILIKE '%syslog stop%'
THEN 'Syslog Tampering'
ELSE 'Other'
END AS blocking_type
FROM events
WHERE LOGSOURCETYPEID IN (12, 253, 352)
AND starttime > NOW() - 86400000
AND (
(eventid = 1 AND (
"CommandLine" ILIKE '%Set-EtwTraceProvider%' OR
"CommandLine" ILIKE '%Remove-EtwTraceProvider%' OR
"CommandLine" ILIKE '%logman stop%' OR
"CommandLine" ILIKE '%logman delete%' OR
"CommandLine" ILIKE '%logman update%' OR
"CommandLine" ILIKE '%EtwEventWrite%' OR
"CommandLine" ILIKE '%NtTraceEvent%' OR
"CommandLine" ILIKE '%NtTraceControl%' OR
"CommandLine" ILIKE '%CrashDumpEnabled%' OR
"CommandLine" ILIKE '%systemctl stop rsyslog%' OR
"CommandLine" ILIKE '%systemctl stop syslog-ng%' OR
"CommandLine" ILIKE '%service rsyslog stop%' OR
"CommandLine" ILIKE '%service syslog stop%' OR
"CommandLine" ILIKE '%esxcli system syslog%'
))
OR (eventid IN (12, 13) AND "TargetObject" ILIKE '%CrashControl%CrashDumpEnabled%')
)
ORDER BY starttime DESCDetects T1562.006 Indicator Blocking in QRadar by querying Sysmon process creation (EventID 1) and registry events (EventID 12/13) for ETW tampering commands, crash dump registry modifications, and syslog daemon shutdown commands. Uses LOGSOURCETYPEID filtering for Sysmon (12) and WinEventLog (253) log sources.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled tasks or monitoring agents that periodically reconfigure ETW trace sessions for telemetry management
- OS patching processes that temporarily stop syslog services during package upgrades on Linux servers
- Crash dump settings modified by enterprise imaging tools during OS deployment or system hardening baselines
Other platforms for T1562.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stop ETW Trace Session with logman
Expected signal: Sysmon Event ID 1: logman.exe with CommandLine 'stop EventLog-Application -ets'.
- Test 2Disable Crash Dumps via Registry
Expected signal: Sysmon Event ID 13: Registry value set for CrashControl\CrashDumpEnabled=0. Sysmon Event ID 1: reg.exe process creation.
- Test 3Stop rsyslog Service on Linux
Expected signal: Auditd execve record for systemctl stop rsyslog. Syslog may capture its own stop (depending on timing). MDE DeviceProcessEvents if deployed.
References (5)
- https://attack.mitre.org/techniques/T1562/006/
- https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.006/T1562.006.md
- https://posts.specterops.io/data-source-analysis-and-dynamic-windows-re-authentication-a-]
Unlock Pro Content
Get the full detection package for T1562.006 including response playbook, investigation guide, and atomic red team tests.