Windows Registry EventLog Service File Location Tampering

title: Windows Registry EventLog Service File Location Tampering
id: d9acc2de-6f2a-427a-9daa-2fb2c0cdb177
status: test
description: This rule identifies registry changes that affect the EventLog service file location by matching keys under SYSTEM\CurrentControlSet\Services\EventLog\ and values ending with \File. Attackers may use this to redirect where .evtx logs are written, impairing log collection and alerting. The detection relies on registry set telemetry capturing the TargetObject and additional Details content for exclusion.
references:
  - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_evtx_file_key_tamper.yml
author: D3F7A5105, Huntrule Team
date: 2023-01-02
modified: 2023-08-17
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\
    TargetObject|endswith: \File
  filter:
    Details|contains: \System32\Winevt\Logs\
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0cb8d736-995d-4ce7-a31e-1e8d452a1459
    type: derived