Correlates registry modifications to EventLog or WMI Autologger keys, suspicious use of Set-EtwTraceProvider, and Sysmon configuration changes. Defender sees interruption or redirection of ETW and log event collection.
| Data Component | Name | Channel |
|---|---|---|
| Host Status (DC0018) | WinEventLog:Sysmon | EventCode=16 |
| Windows Registry Key Modification (DC0063) | WinEventLog:Security | EventCode=4657 |
| Field | Description |
|---|---|
| MonitoredETWProviders | List of ETW providers to baseline and monitor for unexpected removal. |
| AuthorizedConfigChanges | Whitelist of expected admin actions modifying Sysmon or ETW configurations. |
Detects disabling or reconfiguration of syslog or rsyslog services. Monitors sudden stops in logging daemons and suspicious execution of kill or service stop commands targeting syslog processes.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | auditd:SYSCALL | execve: service stop syslog, systemctl stop rsyslog, kill -9 syslog |
| Process Termination (DC0033) | linux:osquery | unexpected termination of syslog or rsyslog processes |
| Field | Description |
|---|---|
| SyslogServiceName | Service name for syslog daemon, which can differ across distributions. |
Detection of tampering with Apple's Unified Logging framework or modification of system log forwarding settings. Defender observes execution of logd-related commands or defaults write to logging preferences.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | macos:unifiedlog | defaults write com.apple.system.logging or logd manipulation |
| Field | Description |
|---|---|
| AllowedLogConfigs | Baseline of approved logging preference modifications to reduce noise. |
Detection of syslog configuration tampering using esxcli system syslog config set or reload. Defender correlates command execution with absence of syslog forwarding activity.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | esxi:hostd | esxcli system syslog config set or reload |
| Field | Description |
|---|---|
| SyslogServerBaseline | Expected syslog destination servers for ESXi hosts. |