huntrule

Windows Process Creation: Disable Security Event Logging via Registry MiniNt Key

Flags reg.exe or PowerShell commands that create/modify the MiniNt registry key to impair Windows event logging.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Disable Security Event Logging via Registry MiniNt Key"
id: d0862882-7411-4923-b549-3a1e1eb00046
related:
  - id: 8839e550-52d7-4958-9f2f-e13c1e736838
    type: similar
  - id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462
    type: derived
status: experimental
description: This rule identifies process activity where reg.exe or PowerShell creates or modifies the registry path containing the MiniNt key under SYSTEM\CurrentControlSet\Control. Disabling related event logging capabilities can reduce visibility into security-relevant activity. It relies on process creation telemetry including the executed image, original file name, and command-line parameters that reference the MiniNt registry location.
references:
  - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_event_logging_disable_via_key_minint.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-09
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1685.001
  - attack.t1112
  - car.2022-03-001
logsource:
  category: process_creation
  product: windows
detection:
  selection_reg_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_reg_cmd:
    CommandLine|contains|all:
      - " add "
      - \SYSTEM\CurrentControlSet\Control\MiniNt
  selection_powershell_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
        - \powershell_ise.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_powershell_cmd1:
    CommandLine|contains:
      - "New-Item "
      - "ni "
  selection_powershell_cmd2:
    CommandLine|contains: \SYSTEM\CurrentControlSet\Control\MiniNt
  condition: all of selection_reg_* or all of selection_powershell_*
falsepositives:
  - Highly Unlikely
level: high
license: DRL-1.1

What it detects

This rule identifies process activity where reg.exe or PowerShell creates or modifies the registry path containing the MiniNt key under SYSTEM\CurrentControlSet\Control. Disabling related event logging capabilities can reduce visibility into security-relevant activity. It relies on process creation telemetry including the executed image, original file name, and command-line parameters that reference the MiniNt registry location.

Known false positives

  • Highly Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.