Windows Registry EventLog ChannelAccess SDDL Tampering Detection

title: Windows Registry EventLog ChannelAccess SDDL Tampering Detection
id: aa35c2c6-3db8-4d9b-b25b-d4794851727a
status: experimental
description: This rule identifies registry modifications to Windows Event Log channel access settings by matching changes to the ChannelAccess values containing Security Descriptor Definition Language (SDDL) patterns. Attackers can use this to restrict who can view or manage specific event log channels, supporting defense evasion by impairing monitoring and forensic visibility. The detection relies on registry_set telemetry that records the TargetObject path and the modified Details content, with exclusions for benign installer/service activity from TrustedInstaller and TiWorker processes.
references:
  - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell
  - https://www.youtube.com/watch?v=uSYvHUVU8xY
  - https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_windows_event_log_access.yml
author: X__Junior, Huntrule Team
date: 2025-01-16
modified: 2025-08-16
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.defense-impairment
  - attack.t1547.001
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection_key_1:
    TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\
    TargetObject|endswith: \CustomSD
  selection_key_2:
    TargetObject|contains:
      - \Policies\Microsoft\Windows\EventLog\
      - \Microsoft\Windows\CurrentVersion\WINEVT\Channels
    TargetObject|endswith: \ChannelAccess
  selection_details:
    - Details|contains: D:(D;
    - Details|contains|all:
        - D:(
        - )(D;
  filter_main_trustedinstaller:
    Image: C:\Windows\servicing\TrustedInstaller.exe
  filter_main_tiworker:
    Image|startswith: C:\Windows\WinSxS\
    Image|endswith: \TiWorker.exe
  filter_optional_empty:
    Image: ""
  filter_optional_null:
    Image: null
  condition: 1 of selection_key_* and selection_details and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Administrative activity, still unlikely
level: high
license: DRL-1.1
related:
  - id: ba226dcf-d390-4642-b9af-b534872f1156
    type: derived