Security Event Logging Disabled via MiniNt Registry Key - Registry Set

calendar Oct 23, 2025 · attack.persistence attack.defense-evasion attack.t1562.002 attack.t1112 car.2022-03-001  ·
Share on: linkedin copy

Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.

Sigma rule (View on GitHub)

 1title: Security Event Logging Disabled via MiniNt Registry Key - Registry Set
 2id: 8839e550-52d7-4958-9f2f-e13c1e736838
 3related:
 4    - id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462 # Security Event Logging Disabled Via MiniNt Registry Key
 5      type: similar
 6status: experimental
 7description: |
 8    Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events.
 9    Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing.
10    Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.    
11references:
12    - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
13author: Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2025-04-09
15tags:
16    - attack.persistence
17    - attack.defense-evasion
18    - attack.t1562.002
19    - attack.t1112
20    - car.2022-03-001
21logsource:
22    category: registry_set
23    product: windows
24detection:
25    selection:
26        TargetObject: 'HKLM\System\CurrentControlSet\Control\MiniNt\(Default)'
27    condition: selection
28falsepositives:
29    - Highly Unlikely
30level: high

References

Related rules

to-top