{"id":"919f2ef0-be2d-4a7a-b635-eb2b41fde044","title":"Disable Security Events Logging Adding Reg Key MiniNt","description":"Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.","author":"Ilyas Ochkov, oscd.community","status":"test","level":"high","date":"2019-10-25","modified":"2021-11-27","tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1112","car.2022-03-001"],"technique_ids":["T1112","T1685.001"],"logsource":{"category":"registry_event","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/0gtweet/status/1182516740955226112","https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/"],"source_path":"rules/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml","source_sha256":"bfbea47b6211e3ae684472b9570191ea22c760857f88d5f8649f0a9e5c106ebe","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Disable Security Events Logging Adding Reg Key MiniNt\nid: 919f2ef0-be2d-4a7a-b635-eb2b41fde044\nstatus: test\ndescription: Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.\nreferences:\n    - https://twitter.com/0gtweet/status/1182516740955226112\n    - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/\nauthor: Ilyas Ochkov, oscd.community\ndate: 2019-10-25\nmodified: 2021-11-27\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1685.001\n    - attack.t1112\n    - car.2022-03-001\nlogsource:\n    category: registry_event\n    product: windows\ndetection:\n    selection:\n    # Sysmon gives us HKLM\\SYSTEM\\CurrentControlSet\\.. if ControlSetXX is the selected one\n        - TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\MiniNt'\n          EventType: 'CreateKey'    # we don't want deletekey\n    # key rename\n        - NewName: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\MiniNt'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"},{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"}],"data_path":"data/detection-rules/919f2ef0-be2d-4a7a-b635-eb2b41fde044.json","kind":"sigma"}