Query: rule covering Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel
Matching passage: Sigma rule: Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel. Logsource: windows / registry_set. Rule: title: Disable Windows Event Logging Via Registry id: 2f78da12-f7c7-430b-8b19-a28f269b77a3 status: test description: Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel references: - https://twitter.com/WhichbufferArda/status/1543900539280293889 - https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-07-04 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\ TargetObject|endswith: \Enabled Details: DWORD (0x00000000) filter_main_wevutil: Image: C:\Windows\system32\wevtutil.exe filter_main_iis: Image|startswith: C:\Windows\winsxs\ Image|endswith: \TiWorker.exe filter_main_svchost: Image: C:\Windows\System32\svchost.exe TargetObject|contains: - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-FileInfoMinifilter - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ASN1\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-AppCompat\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime\Error\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CAPI2/Operational\ filter_main_trusted_installer: Image: C:\Windows\servicing\TrustedInstaller.exe TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Compat-Appraiser filter_optional_empty: Image: '' filter_optional_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting level: high
Near-miss passage: Sigma rule: Detects loading of specific system DLL files that are usually not present on the system (or at least not in system direc. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of Non-Existent DLLs From System Folders id: 6b98b92b-4f00-4f62-b4fe-4d1920215771 related: - id: df6ecb8b-7822-4f4b-b412-08f524b4576c type: similar - id: 602a1f13-c640-4d73-b053-be9a2fa58b77 type: obsolete status: test description: 'Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs. ' references: - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/ - https://decoded.avast.io/martinchlumecky/png-steganography/ - https://github.com/Wh04m1001/SysmonEoP - https://itm4n.github.io/cdpsvc-dll-hijacking/ - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992 - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/ - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/ - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/ - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/ - https://x.com/0gtweet/status/1564131230941122561 author: Nasreddine Bencherchali (Nextron Systems), SBousseaden date: 2022-12-09 modified: 2026-01-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - :\Windows\System32\axeonoffhelper.dll - :\Windows\System32\cdpsgshims.dll - :\Windows\System32\oci.dll - :\Windows\System32\offdmpsvc.dll - :\Windows\System32\shellchromeapi.dll - :\Windows\System32\TSMSISrv.dll - :\Windows\System32\TSVIPSrv.dll - :\Windows\System32\wbem\wbemcomn.dll - :\Windows\System32\WLBSCTRL.dll - :\Windows\System32\wow64log.dll - :\Windows\System32\WptsExtensions.dll filter_main_ms_signed: Signed: 'true' SignatureStatus: Valid Signature: Microsoft Windows condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high