Rule Info
Name
Windows Event Log Access Tampering Via Registry
Author
X__Junior
Description
Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".
Date
2025-01-16 00:00:00
Modified
2025-02-05 00:00:00
Id
ba226dcf-d390-4642-b9af-b534872f1156
Tags
attack.defense-evasion attack.t1547.001 attack.t1112
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Koifman
Merge PR #5182 from @Koifman - Update `Windows Event Log Access Tampering Via Registry`
2025-02-17
Mohamed Ashraf
Merge PR #5162 from @X-Junior - Add `Windows Event Log Access Tampering Via Registry`
2025-01-30
Scan your endpoints, forensic images or collected files with our portable scanner THOR