Detection rules › Sigma

Potential EventLog File Location Tampering

Severity
high
Author
D3F7A5105
Source
upstream

Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1562.002 Impair Defenses: Disable Windows Event Logging

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: selection

TargetObject|endswith: '\File'
TargetObject|contains: '\SYSTEM\CurrentControlSet\Services\EventLog\'

Stage 2: not filter

Details|contains: '\System32\Winevt\Logs\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailsmatch
  • \System32\Winevt\Logs\
TargetObjectends_with
  • \File
TargetObjectmatch
  • \SYSTEM\CurrentControlSet\Services\EventLog\ corpus 2 (sigma 2)