Detection rules › Sigma

Disable Security Events Logging Adding Reg Key MiniNt

Severity
high
Author
Ilyas Ochkov, oscd.community
Source
upstream

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry
Defense EvasionT1112 Modify Registry, T1562.002 Impair Defenses: Disable Windows Event Logging

Event coverage

ProviderEvent IDTitle
Sysmon12RegistryEvent (Object create and delete)
Sysmon13RegistryEvent (Value Set)
Sysmon14RegistryEvent (Key and Value Rename)

Stages and Predicates

Stage 1: selection

or:
EventType: CreateKey
TargetObject: 'HKLM\SYSTEM\CurrentControlSet\Control\MiniNt'
NewName: 'HKLM\SYSTEM\CurrentControlSet\Control\MiniNt'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventTypeeq
  • CreateKey corpus 2 (sigma 2)
NewNameeq
  • HKLM\SYSTEM\CurrentControlSet\Control\MiniNt
TargetObjecteq
  • HKLM\SYSTEM\CurrentControlSet\Control\MiniNt