Windows Event Log Access Tampering Via Registry

 1title: Windows Event Log Access Tampering Via Registry
 2id: ba226dcf-d390-4642-b9af-b534872f1156
 3status: experimental
 4description: |
 5        Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".
 6references:
 7    - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell
 8    - https://www.youtube.com/watch?v=uSYvHUVU8xY
 9    - https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
10author: X__Junior
11date: 2025-01-16
12modified: 2025-08-16
13tags:
14    - attack.privilege-escalation
15    - attack.persistence
16    - attack.defense-impairment
17    - attack.t1547.001
18    - attack.t1112
19logsource:
20    category: registry_set
21    product: windows
22detection:
23    # O:SYG:SYD:(D;;0x1;;;WD)
24    # O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(D;;0x1;;;WD)
25    selection_key_1:
26        TargetObject|contains: '\SYSTEM\CurrentControlSet\Services\EventLog\'
27        TargetObject|endswith: '\CustomSD'
28    selection_key_2:
29        TargetObject|contains:
30            - '\Policies\Microsoft\Windows\EventLog\'
31            - '\Microsoft\Windows\CurrentVersion\WINEVT\Channels'
32        TargetObject|endswith: '\ChannelAccess'
33    selection_details:
34        - Details|contains: 'D:(D;'
35        - Details|contains|all:
36              - 'D:('
37              - ')(D;'
38    filter_main_trustedinstaller:
39        Image: 'C:\Windows\servicing\TrustedInstaller.exe'
40    filter_main_tiworker:
41        Image|startswith: 'C:\Windows\WinSxS\'
42        Image|endswith: '\TiWorker.exe'
43    filter_optional_empty:
44        Image: ''
45    filter_optional_null:
46        Image: null
47    condition: 1 of selection_key_* and selection_details and not 1 of filter_main_* and not 1 of filter_optional_*
48falsepositives:
49    - Administrative activity, still unlikely
50level: high
51simulation:
52    - type: atomic-red-team
53      name: Modify Event Log Access Permissions via Registry - PowerShell
54      technique: T1562.002
55      atomic_guid: a0cb81f8-44d0-4ac4-a8f3-c5c7f43a12c1
56    - type: atomic-red-team
57      name: Modify Event Log Channel Access Permissions via Registry - PowerShell
58      technique: T1562.002
59      atomic_guid: 8e81d090-0cd6-4d46-863c-eec11311298f
60    - type: atomic-red-team
61      name: Modify Event Log Channel Access Permissions via Registry 2 - PowerShell
62      technique: T1562.002
63      atomic_guid: 85e6eff8-3ed4-4e03-ae50-aa6a404898a5