Windows Registry NGenAssemblyUsageLog Key Tampering via .NET Usage Log Configuration

title: Windows Registry NGenAssemblyUsageLog Key Tampering via .NET Usage Log Configuration
id: 04a517bd-08a7-4e78-935a-3d3a5d95b0ff
status: test
description: This rule flags registry changes to the SOFTWARE\Microsoft\.NETFramework\NGenAssemblyUsageLog key. Attackers can tamper with the .NET Usage Log output location so that expected usage log files are not created, supporting defense impairment and evasion. Detection relies on Windows registry set events that include the full TargetObject path ending in the NGenAssemblyUsageLog key.
references:
  - https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_net_cli_ngenassemblyusagelog.yml
author: frack113, Huntrule Team
date: 2022-11-18
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: SOFTWARE\Microsoft\.NETFramework\NGenAssemblyUsageLog
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 28036918-04d3-423d-91c0-55ecf99fb892
    type: derived