Detect Indicator Blocking in Sumo Logic CSE
Adversaries may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This includes tampering with Event Tracing for Windows (ETW), disabling crash dumps, modifying syslog configuration, redirecting telemetry, or blocking network traffic to SIEM/logging infrastructure. ETW tampering is particularly impactful as many security tools depend on ETW providers for visibility.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Sub-technique
- T1562.006 Indicator Blocking
- Canonical reference
- https://attack.mitre.org/techniques/T1562/006/
Sumo Detection Query
(_sourceCategory="windows/sysmon" OR _sourceCategory="linux/syslog" OR _sourceCategory="windows/security")
| where (%"EventCode" IN ("1", "12", "13") OR _sourceCategory matches "*linux*")
| parse field=CommandLine "*" as cmd_full nodrop
| where (
CommandLine matches "*Set-EtwTraceProvider*" OR
CommandLine matches "*Remove-EtwTraceProvider*" OR
CommandLine matches "*logman stop*" OR
CommandLine matches "*logman delete*" OR
CommandLine matches "*logman update*" OR
CommandLine matches "*EtwEventWrite*" OR
CommandLine matches "*NtTraceEvent*" OR
CommandLine matches "*NtTraceControl*" OR
CommandLine matches "*CrashDumpEnabled*" OR
CommandLine matches "*systemctl stop rsyslog*" OR
CommandLine matches "*systemctl stop syslog-ng*" OR
CommandLine matches "*service rsyslog stop*" OR
CommandLine matches "*service syslog stop*" OR
CommandLine matches "*esxcli system syslog*"
)
OR (
TargetObject matches "*CrashControl*CrashDumpEnabled*"
)
| eval blocking_type = if(CommandLine matches "*Set-EtwTraceProvider*" OR CommandLine matches "*Remove-EtwTraceProvider*" OR CommandLine matches "*logman stop*" OR CommandLine matches "*logman delete*", "ETW Tampering",
if(CommandLine matches "*EtwEventWrite*" OR CommandLine matches "*NtTraceEvent*" OR CommandLine matches "*NtTraceControl*", "ETW API Patching",
if(CommandLine matches "*CrashDumpEnabled*" OR TargetObject matches "*CrashControl*", "Crash Dump Disabled",
if(CommandLine matches "*rsyslog*" OR CommandLine matches "*syslog-ng*" OR CommandLine matches "*syslog stop*", "Syslog Tampering",
"Other"))))
| count by _sourceHost, User, blocking_type, CommandLine, TargetObject, _time
| sort by _time descDetects T1562.006 Indicator Blocking in Sumo Logic by searching Windows Sysmon process creation and registry events alongside Linux syslog data for ETW provider tampering commands, crash dump disabling via registry, and syslog service shutdown. Categorizes detections by blocking type for triage prioritization.
Data Sources
Required Tables
False Positives & Tuning
- Windows Defender or third-party AV products that adjust ETW providers during live response or threat remediation actions
- DevOps pipelines running logman.exe as part of automated performance trace collection in CI/CD environments
- Linux configuration management (Chef, Puppet, Ansible) that stops and restarts syslog services during convergence runs
Other platforms for T1562.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stop ETW Trace Session with logman
Expected signal: Sysmon Event ID 1: logman.exe with CommandLine 'stop EventLog-Application -ets'.
- Test 2Disable Crash Dumps via Registry
Expected signal: Sysmon Event ID 13: Registry value set for CrashControl\CrashDumpEnabled=0. Sysmon Event ID 1: reg.exe process creation.
- Test 3Stop rsyslog Service on Linux
Expected signal: Auditd execve record for systemctl stop rsyslog. Syslog may capture its own stop (depending on timing). MDE DeviceProcessEvents if deployed.
References (5)
- https://attack.mitre.org/techniques/T1562/006/
- https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.006/T1562.006.md
- https://posts.specterops.io/data-source-analysis-and-dynamic-windows-re-authentication-a-]
Unlock Pro Content
Get the full detection package for T1562.006 including response playbook, investigation guide, and atomic red team tests.