Windows Registry: Tampering ChannelAccess Permissions for WINEVT Event Channels
Alerts on registry updates to WINEVT ChannelAccess that set SDDL permissions granting elevated access to event channels.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-09-17
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry changes to the ChannelAccess entry under the WINEVT Channels path when the value contains specific SDDL permission strings granting elevated access (e.g., Local System or Administrators). Attackers can use this to impair monitoring or control who can read or manage Windows event channels, potentially reducing detection visibility. It relies on Windows registry set telemetry capturing the TargetObject and the Details fields that include the SDDL access control entries, while excluding activity performed by TrustedInstaller and TiWorker.exe.
Reporting behind it
- app.any.runhttps://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/api/winevt/
- itconnect.uw.eduhttps://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_change_winevt_channelaccess.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Tampering ChannelAccess Permissions for WINEVT Event Channels"
id: f785442d-62dc-4c34-a019-bbfb4cd40ca3
status: test
description: This rule flags registry changes to the ChannelAccess entry under the WINEVT Channels path when the value contains specific SDDL permission strings granting elevated access (e.g., Local System or Administrators). Attackers can use this to impair monitoring or control who can read or manage Windows event channels, potentially reducing detection visibility. It relies on Windows registry set telemetry capturing the TargetObject and the Details fields that include the SDDL access control entries, while excluding activity performed by TrustedInstaller and TiWorker.exe.
references:
- https://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/
- https://learn.microsoft.com/en-us/windows/win32/api/winevt/
- https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_change_winevt_channelaccess.yml
author: frack113, Huntrule Team
date: 2022-09-17
modified: 2024-03-25
tags:
- attack.defense-impairment
- attack.t1685.001
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\
TargetObject|endswith: \ChannelAccess
Details|contains:
- (A;;0x1;;;LA)
- (A;;0x1;;;SY)
- (A;;0x5;;;BA)
filter_main_trustedinstaller:
Image: C:\Windows\servicing\TrustedInstaller.exe
filter_main_tiworker:
Image|startswith: C:\Windows\WinSxS\
Image|endswith: \TiWorker.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7d9263bd-dc47-4a58-bc92-5474abab390c
type: derived