Query: detect Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Defi in logs
Matching passage: Sigma rule: Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Defi. Logsource: windows / registry_set. Rule: title: Windows Event Log Access Tampering Via Registry id: ba226dcf-d390-4642-b9af-b534872f1156 status: experimental description: 'Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn''t be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil". ' references: - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell - https://www.youtube.com/watch?v=uSYvHUVU8xY - https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language author: X__Junior date: 2025-01-16 modified: 2025-08-16 tags: - attack.privilege-escalation - attack.persistence - attack.defense-impairment - attack.t1547.001 - attack.t1112 logsource: category: registry_set product: windows detection: selection_key_1: TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\ TargetObject|endswith: \CustomSD selection_key_2: TargetObject|contains: - \Policies\Microsoft\Windows\EventLog\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels TargetObject|endswith: \ChannelAccess selection_details: - Details|contains: D:(D; - Details|contains|all: - D:( - )(D; filter_main_trustedinstaller: Image: C:\Windows\servicing\TrustedInstaller.exe filter_main_tiworker: Image|startswith: C:\Windows\WinSxS\ Image|endswith: \TiWorker.exe filter_optional_empty: Image: '' filter_optional_null: Image: null condition: 1 of selection_key_* and selection_details and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative activity, still unlikely level: high
Near-miss passage: Sigma rule: Detects use of chcp to look up the system locale value as part of host discovery. Logsource: windows / process_creation. Rule: title: Console CodePage Lookup Via CHCP id: 7090adee-82e2-4269-bd59-80691e7c6338 status: test description: Detects use of chcp to look up the system locale value as part of host discovery references: - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp author: _pete_0, TheDFIRReport date: 2022-02-21 modified: 2024-03-05 tags: - attack.discovery - attack.t1614.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \cmd.exe ParentCommandLine|contains|windash: - ' -c ' - ' -r ' - ' -k ' Image|endswith: \chcp.com CommandLine|endswith: - chcp - 'chcp ' - 'chcp ' condition: selection falsepositives: - During Anaconda update the 'conda.exe' process will eventually execution the 'chcp' command. - Discord was seen using chcp to look up code pages level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup/info.yml