{"id":"1a4bd6af-99ac-4466-b5b2-7b72b4a05462","title":"Security Event Logging Disabled via MiniNt Registry Key - Process","description":"Detects attempts to disable security event logging by adding the `MiniNt` registry key.\nThis key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.\nAdversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-04-09","modified":"","tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1112","car.2022-03-001"],"technique_ids":["T1112","T1685.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Highly Unlikely"],"references":["https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/"],"source_path":"rules/windows/process_creation/proc_creation_win_event_logging_disable_via_key_minint.yml","source_sha256":"81819bd76789a8dde20cc1a3f69fea17dfcfaae2219d5110d55d4374401f1ea5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_event_logging_disable_via_key_minint.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Security Event Logging Disabled via MiniNt Registry Key - Process\nid: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462\nrelated:\n    - id: 8839e550-52d7-4958-9f2f-e13c1e736838 # Disable Security Events Logging Adding Reg Key MiniNt - Registry Set\n      type: similar\nstatus: experimental\ndescription: |\n    Detects attempts to disable security event logging by adding the `MiniNt` registry key.\n    This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.\n    Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.\nreferences:\n    - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-04-09\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1685.001\n    - attack.t1112\n    - car.2022-03-001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_reg_img:\n        # Example: reg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNt\"\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_reg_cmd:\n        CommandLine|contains|all:\n            - ' add '\n            - '\\SYSTEM\\CurrentControlSet\\Control\\MiniNt'\n    selection_powershell_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\powershell_ise.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_powershell_cmd1:\n        CommandLine|contains:\n            - 'New-Item '\n            - 'ni '\n    selection_powershell_cmd2:\n        CommandLine|contains: '\\SYSTEM\\CurrentControlSet\\Control\\MiniNt'\n    condition: all of selection_reg_* or all of selection_powershell_*\nfalsepositives:\n    - Highly Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"},{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"}],"data_path":"data/detection-rules/1a4bd6af-99ac-4466-b5b2-7b72b4a05462.json","kind":"sigma"}