Query: alert when Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Defi
Matching passage: Sigma rule: Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Defi. Logsource: windows / registry_set. Rule: title: Windows Event Log Access Tampering Via Registry id: ba226dcf-d390-4642-b9af-b534872f1156 status: experimental description: 'Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn''t be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil". ' references: - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell - https://www.youtube.com/watch?v=uSYvHUVU8xY - https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language author: X__Junior date: 2025-01-16 modified: 2025-08-16 tags: - attack.privilege-escalation - attack.persistence - attack.defense-impairment - attack.t1547.001 - attack.t1112 logsource: category: registry_set product: windows detection: selection_key_1: TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\ TargetObject|endswith: \CustomSD selection_key_2: TargetObject|contains: - \Policies\Microsoft\Windows\EventLog\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels TargetObject|endswith: \ChannelAccess selection_details: - Details|contains: D:(D; - Details|contains|all: - D:( - )(D; filter_main_trustedinstaller: Image: C:\Windows\servicing\TrustedInstaller.exe filter_main_tiworker: Image|startswith: C:\Windows\WinSxS\ Image|endswith: \TiWorker.exe filter_optional_empty: Image: '' filter_optional_null: Image: null condition: 1 of selection_key_* and selection_details and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative activity, still unlikely level: high
Near-miss passage: Sigma rule: Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applicat. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Custom Protocol Handler id: fdbf0b9d-0182-4c43-893b-a1eaab92d085 status: test description: Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism. references: - https://ladydebug.com/blog/2019/06/21/custom-protocol-handler-cph/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-30 modified: 2023-05-12 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|startswith: HKCR\ Details|startswith: 'URL:' filter_main_ms_trusted: Details|startswith: URL:ms- filter_main_generic_locations: Image|startswith: - C:\Program Files (x86) - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: selection and not 1 of filter_main_* falsepositives: - Many legitimate applications can register a new custom protocol handler. Additional filters needs to applied according to your environment. level: medium