{"id":"2f78da12-f7c7-430b-8b19-a28f269b77a3","title":"Disable Windows Event Logging Via Registry","description":"Detects tampering with the \"Enabled\" registry key in order to disable Windows logging of a Windows event channel","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-04","modified":"2024-03-25","tags":["attack.defense-impairment","attack.t1685.001"],"technique_ids":["T1685.001"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting"],"references":["https://twitter.com/WhichbufferArda/status/1543900539280293889","https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp"],"source_path":"rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml","source_sha256":"2d8718ab6e4692fa0afd9210cae634fb54beb7d7e921c4c8e5bd0ba4711be2c4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Disable Windows Event Logging Via Registry\nid: 2f78da12-f7c7-430b-8b19-a28f269b77a3\nstatus: test\ndescription: Detects tampering with the \"Enabled\" registry key in order to disable Windows logging of a Windows event channel\nreferences:\n    - https://twitter.com/WhichbufferArda/status/1543900539280293889\n    - https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp\nauthor: frack113, Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-07-04\nmodified: 2024-03-25\ntags:\n    - attack.defense-impairment\n    - attack.t1685.001\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains: '\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\'\n        TargetObject|endswith: '\\Enabled'\n        Details: 'DWORD (0x00000000)'\n    filter_main_wevutil:\n        Image: 'C:\\Windows\\system32\\wevtutil.exe' # FP generated during installation of manifests via wevtutil\n    filter_main_iis:\n        Image|startswith: 'C:\\Windows\\winsxs\\'\n        Image|endswith: '\\TiWorker.exe'  # Many different TargetObjects\n    filter_main_svchost:\n        Image: 'C:\\Windows\\System32\\svchost.exe'\n        TargetObject|contains:\n            - '\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-FileInfoMinifilter'\n            - '\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-ASN1\\'\n            - '\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Kernel-AppCompat\\'\n            - '\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Runtime\\Error\\'\n            - '\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-CAPI2/Operational\\'\n    filter_main_trusted_installer:\n        Image: C:\\Windows\\servicing\\TrustedInstaller.exe\n        TargetObject|contains: '\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Compat-Appraiser'\n    filter_optional_empty: # This filter is related to aurora. Should be removed when fix is deployed. # TODO: Remove later\n        Image: ''\n    filter_optional_null: # This filter is related to aurora. Should be removed when fix is deployed. # TODO: Remove later\n        Image: null\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"}],"data_path":"data/detection-rules/2f78da12-f7c7-430b-8b19-a28f269b77a3.json","kind":"sigma"}