detection.wiki

Detection rules › Sigma

Security Event Logging Disabled via MiniNt Registry Key - Process

Status
experimental
Severity
high
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects attempts to disable security event logging by adding the MiniNt registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry
Defense ImpairmentT1112 Modify Registry, T1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Security Event Logging Disabled via MiniNt Registry Key - Process
id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462
related:
    - id: 8839e550-52d7-4958-9f2f-e13c1e736838 # Disable Security Events Logging Adding Reg Key MiniNt - Registry Set
      type: similar
status: experimental
description: |
    Detects attempts to disable security event logging by adding the `MiniNt` registry key.
    This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.
    Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.
references:
    - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-04-09
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1685.001
    - attack.t1112
    - car.2022-03-001
logsource:
    category: process_creation
    product: windows
detection:
    selection_reg_img:
        # Example: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNt"
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_reg_cmd:
        CommandLine|contains|all:
            - ' add '
            - '\SYSTEM\CurrentControlSet\Control\MiniNt'
    selection_powershell_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\powershell_ise.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_powershell_cmd1:
        CommandLine|contains:
            - 'New-Item '
            - 'ni '
    selection_powershell_cmd2:
        CommandLine|contains: '\SYSTEM\CurrentControlSet\Control\MiniNt'
    condition: all of selection_reg_* or all of selection_powershell_*
falsepositives:
    - Highly Unlikely
level: high

Stages and Predicates

Stage 0: condition

all of selection_reg_* or all of selection_powershell_*

Stage 1: selection_reg_img

selection_reg_img:
    # Example: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNt"
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 2: selection_reg_cmd

selection_reg_cmd:
    CommandLine|contains|all:
        - ' add '
        - '\SYSTEM\CurrentControlSet\Control\MiniNt'

Stage 3: selection_powershell_img

selection_powershell_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
          - '\powershell_ise.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'

Stage 4: selection_powershell_cmd1

selection_powershell_cmd1:
    CommandLine|contains:
        - 'New-Item '
        - 'ni '

Stage 5: selection_powershell_cmd2

selection_powershell_cmd2:
    CommandLine|contains: '\SYSTEM\CurrentControlSet\Control\MiniNt'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • add corpus 15 (sigma 13, splunk 1, chronicle 1)
  • New-Item
  • \SYSTEM\CurrentControlSet\Control\MiniNt
  • ni corpus 2 (sigma 2)
Imageends_with
  • \powershell.exe corpus 186 (sigma 186)
  • \powershell_ise.exe corpus 42 (sigma 42)
  • \pwsh.exe corpus 172 (sigma 172)
  • \reg.exe corpus 60 (sigma 60)
OriginalFileNameeq
  • PowerShell.EXE corpus 121 (sigma 85, splunk 30, elastic 6)
  • pwsh.dll corpus 112 (sigma 79, splunk 30, elastic 3)
  • reg.exe corpus 42 (sigma 32, splunk 8, elastic 2)