Security Event Logging Disabled via MiniNt Registry Key - Process

 1title: Security Event Logging Disabled via MiniNt Registry Key - Process
 2id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462
 3related:
 4    - id: 8839e550-52d7-4958-9f2f-e13c1e736838 # Disable Security Events Logging Adding Reg Key MiniNt - Registry Set
 5      type: similar
 6status: experimental
 7description: |
 8    Detects attempts to disable security event logging by adding the `MiniNt` registry key.
 9    This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.
10    Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.    
11references:
12    - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
13author: Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2025-04-09
15tags:
16    - attack.defense-evasion
17    - attack.t1562.002
18    - attack.t1112
19    - car.2022-03-001
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection_reg_img:
25        # Example: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNt"
26        - Image|endswith: '\reg.exe'
27        - OriginalFileName: 'reg.exe'
28    selection_reg_cmd:
29        CommandLine|contains|all:
30            - ' add '
31            - '\SYSTEM\CurrentControlSet\Control\MiniNt'
32    selection_powershell_img:
33        - Image|endswith:
34              - '\powershell.exe'
35              - '\pwsh.exe'
36              - '\powershell_ise.exe'
37        - OriginalFileName:
38              - 'PowerShell.EXE'
39              - 'pwsh.dll'
40    selection_powershell_cmd1:
41        CommandLine|contains:
42            - 'New-Item '
43            - 'ni '
44    selection_powershell_cmd2:
45        CommandLine|contains: '\SYSTEM\CurrentControlSet\Control\MiniNt'
46    condition: all of selection_reg_* or all of selection_powershell_*
47falsepositives:
48    - Highly Unlikely
49level: high