Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Defi. Logsource: windows / registry_set. Rule: title: Windows Event Log Access Tampering Via Registry id: ba226dcf-d390-4642-b9af-b534872f1156 status: experimental description: 'Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn''t be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil". ' references: - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell - https://www.youtube.com/watch?v=uSYvHUVU8xY - https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language author: X__Junior date: 2025-01-16 modified: 2025-08-16 tags: - attack.privilege-escalation - attack.persistence - attack.defense-impairment - attack.t1547.001 - attack.t1112 logsource: category: registry_set product: windows detection: selection_key_1: TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\ TargetObject|endswith: \CustomSD selection_key_2: TargetObject|contains: - \Policies\Microsoft\Windows\EventLog\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels TargetObject|endswith: \ChannelAccess selection_details: - Details|contains: D:(D; - Details|contains|all: - D:( - )(D; filter_main_trustedinstaller: Image: C:\Windows\servicing\TrustedInstaller.exe filter_main_tiworker: Image|startswith: C:\Windows\WinSxS\ Image|endswith: \TiWorker.exe filter_optional_empty: Image: '' filter_optional_null: Image: null condition: 1 of selection_key_* and selection_details and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative activity, still unlikely level: high
Near-miss passage: Sigma rule: Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-b. Logsource: windows / registry_delete. Rule: title: Windows Credential Guard Related Registry Value Deleted - Registry id: d645ef86-2396-48a1-a2b6-b629ca3f57ff related: - id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9 type: similar status: experimental description: 'Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. ' references: - https://github.com/DambergC/SaveFolder/blob/90e945eba80fae85f2d54b4616e05a44ec90c500/Cygate%20Installation%20tool%206.22/Script/OSD/OSDeployment-CredentialGuardDisable.ps1#L50 - https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_delete product: windows detection: selection: TargetObject|endswith: - \DeviceGuard\EnableVirtualizationBasedSecurity - \DeviceGuard\LsaCfgFlags - \DeviceGuard\RequirePlatformSecurityFeatures - \Lsa\LsaCfgFlags condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard/info.yml