Sigma rule: Security Event Logging Disabled via MiniNt Registry Key - Process

Rule

Title

Security Event Logging Disabled via MiniNt Registry Key - Process

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-04-09

File

rules/windows/process_creation/proc_creation_win_event_logging_disable_via_key_minint.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects attempts to disable security event logging by adding the `MiniNt` registry key.
This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.
Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.

Log source

product

windows

category

process_creation

Detection

selection_reg_img:
    # Example: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNt"
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'
selection_reg_cmd:
    CommandLine|contains|all:
        - ' add '
        - '\SYSTEM\CurrentControlSet\Control\MiniNt'
selection_powershell_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
          - '\powershell_ise.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'
selection_powershell_cmd1:
    CommandLine|contains:
        - 'New-Item '
        - 'ni '
selection_powershell_cmd2:
    CommandLine|contains: '\SYSTEM\CurrentControlSet\Control\MiniNt'
condition: all of selection_reg_* or all of selection_powershell_*

False positives (as the rule lists them)

• Highly Unlikely

Tags

• attack.persistence
• attack.defense-impairment
• attack.t1685.001
• attack.t1112
• car.2022-03-001

MITRE ATT&CK ids this rule names

• T1112
• T1685.001

Related rules

• 8839e550-52d7-4958-9f2f-e13c1e736838 (similar)

References

• https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_event_logging_disable_via_key_minint.yml