Query: write Sigma for Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Defi
Matching passage: Sigma rule: Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Defi. Logsource: windows / registry_set. Rule: title: Windows Event Log Access Tampering Via Registry id: ba226dcf-d390-4642-b9af-b534872f1156 status: experimental description: 'Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn''t be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil". ' references: - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell - https://www.youtube.com/watch?v=uSYvHUVU8xY - https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language author: X__Junior date: 2025-01-16 modified: 2025-08-16 tags: - attack.privilege-escalation - attack.persistence - attack.defense-impairment - attack.t1547.001 - attack.t1112 logsource: category: registry_set product: windows detection: selection_key_1: TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\ TargetObject|endswith: \CustomSD selection_key_2: TargetObject|contains: - \Policies\Microsoft\Windows\EventLog\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels TargetObject|endswith: \ChannelAccess selection_details: - Details|contains: D:(D; - Details|contains|all: - D:( - )(D; filter_main_trustedinstaller: Image: C:\Windows\servicing\TrustedInstaller.exe filter_main_tiworker: Image|startswith: C:\Windows\WinSxS\ Image|endswith: \TiWorker.exe filter_optional_empty: Image: '' filter_optional_null: Image: null condition: 1 of selection_key_* and selection_details and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative activity, still unlikely level: high
Near-miss passage: Sigma rule: Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious acti. Logsource: windows / process_creation. Rule: title: Wscript Shell Run In CommandLine id: 2c28c248-7f50-417a-9186-a85b223010ee status: test description: Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity references: - https://web.archive.org/web/20220830122045/http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html - https://blog.talosintelligence.com/modernloader-delivers-multiple-stealers-cryptominers-and-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 modified: 2023-05-15 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - Wscript. - .Shell - .Run condition: selection falsepositives: - Inline scripting can be used by some rare third party applications or administrators. Investigate and apply additional filters accordingly level: medium