Windows Registry: Tampering ChannelAccess Permissions for WINEVT Event Channels

title: "Windows Registry: Tampering ChannelAccess Permissions for WINEVT Event Channels"
id: f785442d-62dc-4c34-a019-bbfb4cd40ca3
status: test
description: This rule flags registry changes to the ChannelAccess entry under the WINEVT Channels path when the value contains specific SDDL permission strings granting elevated access (e.g., Local System or Administrators). Attackers can use this to impair monitoring or control who can read or manage Windows event channels, potentially reducing detection visibility. It relies on Windows registry set telemetry capturing the TargetObject and the Details fields that include the SDDL access control entries, while excluding activity performed by TrustedInstaller and TiWorker.exe.
references:
  - https://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/
  - https://learn.microsoft.com/en-us/windows/win32/api/winevt/
  - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_change_winevt_channelaccess.yml
author: frack113, Huntrule Team
date: 2022-09-17
modified: 2024-03-25
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\
    TargetObject|endswith: \ChannelAccess
    Details|contains:
      - (A;;0x1;;;LA)
      - (A;;0x1;;;SY)
      - (A;;0x5;;;BA)
  filter_main_trustedinstaller:
    Image: C:\Windows\servicing\TrustedInstaller.exe
  filter_main_tiworker:
    Image|startswith: C:\Windows\WinSxS\
    Image|endswith: \TiWorker.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7d9263bd-dc47-4a58-bc92-5474abab390c
    type: derived