Sigma rule: Disable Windows Event Logging Via Registry

Rule

Title

Disable Windows Event Logging Via Registry

Status

test

Level

high

Author

frack113, Nasreddine Bencherchali (Nextron Systems)

Date

2022-07-04

Modified

2024-03-25

File

rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains: '\Microsoft\Windows\CurrentVersion\WINEVT\Channels\'
    TargetObject|endswith: '\Enabled'
    Details: 'DWORD (0x00000000)'
filter_main_wevutil:
    Image: 'C:\Windows\system32\wevtutil.exe' # FP generated during installation of manifests via wevtutil
filter_main_iis:
    Image|startswith: 'C:\Windows\winsxs\'
    Image|endswith: '\TiWorker.exe'  # Many different TargetObjects
filter_main_svchost:
    Image: 'C:\Windows\System32\svchost.exe'
    TargetObject|contains:
        - '\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-FileInfoMinifilter'
        - '\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ASN1\'
        - '\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-AppCompat\'
        - '\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime\Error\'
        - '\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CAPI2/Operational\'
filter_main_trusted_installer:
    Image: C:\Windows\servicing\TrustedInstaller.exe
    TargetObject|contains: '\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Compat-Appraiser'
filter_optional_empty: # This filter is related to aurora. Should be removed when fix is deployed. # TODO: Remove later
    Image: ''
filter_optional_null: # This filter is related to aurora. Should be removed when fix is deployed. # TODO: Remove later
    Image: null
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting

Tags

• attack.defense-impairment
• attack.t1685.001

MITRE ATT&CK ids this rule names

• T1685.001

References

• https://twitter.com/WhichbufferArda/status/1543900539280293889
• https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml