Windows Event Log Access Tampering Via Registry

calendar May 20, 2025 · attack.defense-evasion attack.t1547.001 attack.t1112  ·
Share on: linkedin copy

Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Sigma rule (View on GitHub)

 1title: Windows Event Log Access Tampering Via Registry
 2id: ba226dcf-d390-4642-b9af-b534872f1156
 3status: experimental
 4description: |
 5        Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".
 6references:
 7    - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell
 8    - https://www.youtube.com/watch?v=uSYvHUVU8xY
 9    - https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
10author: X__Junior
11date: 2025-01-16
12modified: 2025-02-05
13tags:
14    - attack.defense-evasion
15    - attack.t1547.001
16    - attack.t1112
17logsource:
18    category: registry_set
19    product: windows
20detection:
21    # O:SYG:SYD:(D;;0x1;;;WD)
22    # O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(D;;0x1;;;WD)
23    selection_key_1:
24        TargetObject|contains: '\SYSTEM\CurrentControlSet\Services\EventLog\'
25        TargetObject|endswith: '\CustomSD'
26    selection_key_2:
27        TargetObject|contains:
28            - '\Policies\Microsoft\Windows\EventLog\'
29            - '\Microsoft\Windows\CurrentVersion\WINEVT\Channels'
30        TargetObject|endswith: '\ChannelAccess'
31    selection_details:
32        - Details|contains: 'D:(D;'
33        - Details|contains|all:
34              - 'D:('
35              - ')(D;'
36    condition: 1 of selection_key_* and selection_details
37falsepositives:
38    - Administrative activity, still unlikely
39level: high

References

Related rules

to-top