Query: Sigma rule for Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel
Matching passage: Sigma rule: Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel. Logsource: windows / registry_set. Rule: title: Disable Windows Event Logging Via Registry id: 2f78da12-f7c7-430b-8b19-a28f269b77a3 status: test description: Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel references: - https://twitter.com/WhichbufferArda/status/1543900539280293889 - https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-07-04 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\ TargetObject|endswith: \Enabled Details: DWORD (0x00000000) filter_main_wevutil: Image: C:\Windows\system32\wevtutil.exe filter_main_iis: Image|startswith: C:\Windows\winsxs\ Image|endswith: \TiWorker.exe filter_main_svchost: Image: C:\Windows\System32\svchost.exe TargetObject|contains: - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-FileInfoMinifilter - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ASN1\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-AppCompat\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime\Error\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CAPI2/Operational\ filter_main_trusted_installer: Image: C:\Windows\servicing\TrustedInstaller.exe TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Compat-Appraiser filter_optional_empty: Image: '' filter_optional_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting level: high
Near-miss passage: Sigma rule: Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been r. Logsource: windows / process_creation. Rule: title: Hacktool Execution - Imphash id: 24e3e58a-646b-4b50-adef-02ef935b9fc8 status: test description: Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-04 modified: 2024-11-23 tags: - attack.credential-access - attack.resource-development - attack.t1588.002 - attack.t1003 logsource: category: process_creation product: windows detection: selection: Hashes|contains: - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=F9A28C458284584A93B14216308D31BD - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0BD939EE5E6C141 - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE - IMPHASH=CB567F9498452721D77A451374955F5F - IMPHASH=730073214094CD328547BF1F72289752 - IMPHASH=17B461A082950FC6332228572138B80C - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 - IMPHASH=819B19D53CA6736448F9325A85736792 - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 - IMPHASH=0588081AB0E63BA785938467E1B10CCA - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 - IMPHASH=3AD59991CCF1D67339B319B15A41B35D - IMPHASH=FFDD59E0318B85A3E480874D9796D872 - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 - IMPHASH=38D9E015591BBFD4929E0D0F4