Windows Registry Event Log Tampering by Disabling WINEVT Channel Enabled Key
Flags registry changes that set WINEVT channel Enabled to 0x00000000 to disable Windows event logging.
- Product
- windows
- Category
- registry_set
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-04
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry modifications where a WINEVT channel’s Enabled value is set to DWORD 0x00000000, effectively disabling event logging for a specific Windows event channel. Attackers may use this to evade detection by reducing the availability of audit and telemetry from targeted event sources. It relies on registry_set telemetry capturing the TargetObject path under WINEVT\Channels and the value Details indicating the Enabled key was disabled, with exclusions for common system processes that can legitimately touch these paths.
Reporting behind it
- twitter.comhttps://twitter.com/WhichbufferArda/status/1543900539280293889
- github.comhttps://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Event Log Tampering by Disabling WINEVT Channel Enabled Key
id: 4cf6feab-dde0-4ebb-a89c-1df57af8ed41
status: test
description: This rule identifies registry modifications where a WINEVT channel’s Enabled value is set to DWORD 0x00000000, effectively disabling event logging for a specific Windows event channel. Attackers may use this to evade detection by reducing the availability of audit and telemetry from targeted event sources. It relies on registry_set telemetry capturing the TargetObject path under WINEVT\Channels and the value Details indicating the Enabled key was disabled, with exclusions for common system processes that can legitimately touch these paths.
references:
- https://twitter.com/WhichbufferArda/status/1543900539280293889
- https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-04
modified: 2024-03-25
tags:
- attack.defense-impairment
- attack.t1685.001
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\
TargetObject|endswith: \Enabled
Details: DWORD (0x00000000)
filter_main_wevutil:
Image: C:\Windows\system32\wevtutil.exe
filter_main_iis:
Image|startswith: C:\Windows\winsxs\
Image|endswith: \TiWorker.exe
filter_main_svchost:
Image: C:\Windows\System32\svchost.exe
TargetObject|contains:
- \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-FileInfoMinifilter
- \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ASN1\
- \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-AppCompat\
- \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime\Error\
- \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CAPI2/Operational\
filter_main_trusted_installer:
Image: C:\Windows\servicing\TrustedInstaller.exe
TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Compat-Appraiser
filter_optional_empty:
Image: ""
filter_optional_null:
Image: null
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting
level: high
license: DRL-1.1
related:
- id: 2f78da12-f7c7-430b-8b19-a28f269b77a3
type: derived