Windows Registry EventLog ChannelAccess SDDL Tampering Detection
Detects registry changes to Windows Event Log ChannelAccess SDDL, which can limit event log visibility or control.
- Product
- windows
- Category
- registry_set
- Author
- X__Junior (SigmaHQ), DRL 1.1
- Published
- 2025-01-16
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry modifications to Windows Event Log channel access settings by matching changes to the ChannelAccess values containing Security Descriptor Definition Language (SDDL) patterns. Attackers can use this to restrict who can view or manage specific event log channels, supporting defense evasion by impairing monitoring and forensic visibility. The detection relies on registry_set telemetry that records the TargetObject path and the modified Details content, with exclusions for benign installer/service activity from TrustedInstaller and TiWorker processes.
Reporting behind it
- atomicredteam.iohttps://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell
- youtube.comhttps://www.youtube.com/watch?v=uSYvHUVU8xY
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_windows_event_log_access.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry EventLog ChannelAccess SDDL Tampering Detection
id: aa35c2c6-3db8-4d9b-b25b-d4794851727a
status: experimental
description: This rule identifies registry modifications to Windows Event Log channel access settings by matching changes to the ChannelAccess values containing Security Descriptor Definition Language (SDDL) patterns. Attackers can use this to restrict who can view or manage specific event log channels, supporting defense evasion by impairing monitoring and forensic visibility. The detection relies on registry_set telemetry that records the TargetObject path and the modified Details content, with exclusions for benign installer/service activity from TrustedInstaller and TiWorker processes.
references:
- https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell
- https://www.youtube.com/watch?v=uSYvHUVU8xY
- https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_windows_event_log_access.yml
author: X__Junior, Huntrule Team
date: 2025-01-16
modified: 2025-08-16
tags:
- attack.privilege-escalation
- attack.persistence
- attack.defense-impairment
- attack.t1547.001
- attack.t1112
logsource:
category: registry_set
product: windows
detection:
selection_key_1:
TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\
TargetObject|endswith: \CustomSD
selection_key_2:
TargetObject|contains:
- \Policies\Microsoft\Windows\EventLog\
- \Microsoft\Windows\CurrentVersion\WINEVT\Channels
TargetObject|endswith: \ChannelAccess
selection_details:
- Details|contains: D:(D;
- Details|contains|all:
- D:(
- )(D;
filter_main_trustedinstaller:
Image: C:\Windows\servicing\TrustedInstaller.exe
filter_main_tiworker:
Image|startswith: C:\Windows\WinSxS\
Image|endswith: \TiWorker.exe
filter_optional_empty:
Image: ""
filter_optional_null:
Image: null
condition: 1 of selection_key_* and selection_details and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Administrative activity, still unlikely
level: high
license: DRL-1.1
related:
- id: ba226dcf-d390-4642-b9af-b534872f1156
type: derived