Security Event Logging Disabled via MiniNt Registry Key - Registry Set

calendar Oct 1, 2025 · attack.defense-evasion attack.t1562.002 attack.t1112 car.2022-03-001  ·
Share on: linkedin copy

Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.

Sigma rule (View on GitHub)

 1title: Security Event Logging Disabled via MiniNt Registry Key - Registry Set
 2id: 8839e550-52d7-4958-9f2f-e13c1e736838
 3related:
 4    - id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462 # Security Event Logging Disabled Via MiniNt Registry Key
 5      type: similar
 6status: experimental
 7description: |
 8    Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events.
 9    Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing.
10    Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.    
11references:
12    - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
13author: Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2025-04-09
15tags:
16    - attack.defense-evasion
17    - attack.t1562.002
18    - attack.t1112
19    - car.2022-03-001
20logsource:
21    category: registry_set
22    product: windows
23detection:
24    selection:
25        TargetObject: 'HKLM\System\CurrentControlSet\Control\MiniNt\(Default)'
26    condition: selection
27falsepositives:
28    - Highly Unlikely
29level: high

References

Related rules

to-top