Query: detect Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel in logs
Matching passage: Sigma rule: Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel. Logsource: windows / registry_set. Rule: title: Disable Windows Event Logging Via Registry id: 2f78da12-f7c7-430b-8b19-a28f269b77a3 status: test description: Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel references: - https://twitter.com/WhichbufferArda/status/1543900539280293889 - https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-07-04 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\ TargetObject|endswith: \Enabled Details: DWORD (0x00000000) filter_main_wevutil: Image: C:\Windows\system32\wevtutil.exe filter_main_iis: Image|startswith: C:\Windows\winsxs\ Image|endswith: \TiWorker.exe filter_main_svchost: Image: C:\Windows\System32\svchost.exe TargetObject|contains: - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-FileInfoMinifilter - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ASN1\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-AppCompat\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime\Error\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CAPI2/Operational\ filter_main_trusted_installer: Image: C:\Windows\servicing\TrustedInstaller.exe TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Compat-Appraiser filter_optional_empty: Image: '' filter_optional_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting level: high
Near-miss passage: Sigma rule: Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellS. Logsource: windows / registry_event. Rule: title: Run Once Task Configuration in Registry id: c74d7efc-8826-45d9-b8bb-f04fac9e4eff status: test description: Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup references: - https://twitter.com/pabraeken/status/990717080805789697 - https://lolbas-project.github.io/lolbas/Binaries/Runonce/ author: Avneet Singh @v3t0_, oscd.community date: 2020-11-15 modified: 2024-03-25 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_event detection: selection: TargetObject|contains: \Microsoft\Active Setup\Installed Components TargetObject|endswith: \StubPath filter_optional_chrome: Details|contains|all: - C:\Program Files\Google\Chrome\Application\ - \Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level filter_optional_edge: Details|contains: - C:\Program Files (x86)\Microsoft\Edge\Application\ - C:\Program Files\Microsoft\Edge\Application\ Details|endswith: \Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate modification of the registry key by legitimate program level: medium