Windows Registry Event Log Tampering by Disabling WINEVT Channel Enabled Key

title: Windows Registry Event Log Tampering by Disabling WINEVT Channel Enabled Key
id: 4cf6feab-dde0-4ebb-a89c-1df57af8ed41
status: test
description: This rule identifies registry modifications where a WINEVT channel’s Enabled value is set to DWORD 0x00000000, effectively disabling event logging for a specific Windows event channel. Attackers may use this to evade detection by reducing the availability of audit and telemetry from targeted event sources. It relies on registry_set telemetry capturing the TargetObject path under WINEVT\Channels and the value Details indicating the Enabled key was disabled, with exclusions for common system processes that can legitimately touch these paths.
references:
  - https://twitter.com/WhichbufferArda/status/1543900539280293889
  - https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-04
modified: 2024-03-25
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\
    TargetObject|endswith: \Enabled
    Details: DWORD (0x00000000)
  filter_main_wevutil:
    Image: C:\Windows\system32\wevtutil.exe
  filter_main_iis:
    Image|startswith: C:\Windows\winsxs\
    Image|endswith: \TiWorker.exe
  filter_main_svchost:
    Image: C:\Windows\System32\svchost.exe
    TargetObject|contains:
      - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-FileInfoMinifilter
      - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ASN1\
      - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-AppCompat\
      - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime\Error\
      - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CAPI2/Operational\
  filter_main_trusted_installer:
    Image: C:\Windows\servicing\TrustedInstaller.exe
    TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Compat-Appraiser
  filter_optional_empty:
    Image: ""
  filter_optional_null:
    Image: null
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting
level: high
license: DRL-1.1
related:
  - id: 2f78da12-f7c7-430b-8b19-a28f269b77a3
    type: derived