Security Event Logging Disabled via MiniNt Registry Key - Process

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects attempts to disable security event logging by adding the MiniNt registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.

Known false positives

Highly Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry `T1685.001` Disable or Modify Tools: Disable or Modify Windows Event Log

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Security Event Logging Disabled via MiniNt Registry Key - Process
id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462
related:
    - id: 8839e550-52d7-4958-9f2f-e13c1e736838 # Disable Security Events Logging Adding Reg Key MiniNt - Registry Set
      type: similar
status: experimental
description: |
    Detects attempts to disable security event logging by adding the `MiniNt` registry key.
    This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.
    Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.
references:
    - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-04-09
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1685.001
    - attack.t1112
    - car.2022-03-001
logsource:
    category: process_creation
    product: windows
detection:
    selection_reg_img:
        # Example: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNt"
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_reg_cmd:
        CommandLine|contains|all:
            - ' add '
            - '\SYSTEM\CurrentControlSet\Control\MiniNt'
    selection_powershell_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\powershell_ise.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_powershell_cmd1:
        CommandLine|contains:
            - 'New-Item '
            - 'ni '
    selection_powershell_cmd2:
        CommandLine|contains: '\SYSTEM\CurrentControlSet\Control\MiniNt'
    condition: all of selection_reg_* or all of selection_powershell_*
falsepositives:
    - Highly Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_reg_* or all of selection_powershell_*

Stage 1: `selection_reg_img`

selection_reg_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 2: `selection_reg_cmd`

selection_reg_cmd:
    CommandLine|contains|all:
        - ' add '
        - '\SYSTEM\CurrentControlSet\Control\MiniNt'

Stage 3: `selection_powershell_img`

selection_powershell_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
          - '\powershell_ise.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'

Stage 4: `selection_powershell_cmd1`

selection_powershell_cmd1:
    CommandLine|contains:
        - 'New-Item '
        - 'ni '

Stage 5: `selection_powershell_cmd2`

selection_powershell_cmd2:
    CommandLine|contains: '\SYSTEM\CurrentControlSet\Control\MiniNt'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`add` corpus 15 (sigma 13, splunk 1, chronicle 1) `New-Item` `\SYSTEM\CurrentControlSet\Control\MiniNt` `ni` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\powershell.exe` corpus 179 (sigma 178, kusto 1) `\powershell_ise.exe` corpus 41 (sigma 41) `\pwsh.exe` corpus 165 (sigma 164, kusto 1) `\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`PowerShell.EXE` corpus 138 (sigma 84, splunk 30, elastic 24) `pwsh.dll` corpus 112 (sigma 79, splunk 30, elastic 3) `reg.exe` corpus 43 (sigma 32, splunk 8, elastic 3)	`field:"OriginalFileName" kind:eq`

Security Event Logging Disabled via MiniNt Registry Key - Process

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_reg_img

Stage 2: selection_reg_cmd

Stage 3: selection_powershell_img

Stage 4: selection_powershell_cmd1