huntrule

Windows Registry: MiniNt Key Added to Disable Security Event Logging on Reboot

Flags registry set activity that adds the MiniNt key, which stops Windows Event Log from writing events after a reboot.

FreeUnreviewedSigmahighv1
title: "Windows Registry: MiniNt Key Added to Disable Security Event Logging on Reboot"
id: ff410488-b22b-4927-90d8-ba380d827123
related:
  - id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462
    type: similar
  - id: 8839e550-52d7-4958-9f2f-e13c1e736838
    type: derived
status: experimental
description: This rule identifies when the MiniNt registry key default value is added under HKLM\System\CurrentControlSet\Control\MiniNt, indicating an attempt to disable Windows Event Log behavior after reboot. Disabling event logging impairs auditing and can reduce the visibility of attacker activity that would otherwise be recorded. It relies on registry set telemetry capturing the TargetObject path for the write operation.
references:
  - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_create_minint_key.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-09
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1685.001
  - attack.t1112
  - car.2022-03-001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject: HKLM\System\CurrentControlSet\Control\MiniNt\(Default)
  condition: selection
falsepositives:
  - Highly Unlikely
level: high
license: DRL-1.1

What it detects

This rule identifies when the MiniNt registry key default value is added under HKLM\System\CurrentControlSet\Control\MiniNt, indicating an attempt to disable Windows Event Log behavior after reboot. Disabling event logging impairs auditing and can reduce the visibility of attacker activity that would otherwise be recorded. It relies on registry set telemetry capturing the TargetObject path for the write operation.

Known false positives

  • Highly Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.