Potential EventLog File Location Tampering

Status: test
Severity: high
Log source: category registry_set, product windows
Author: D3F7A5105
Source: github.com/SigmaHQ/sigma

Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685.001` Disable or Modify Tools: Disable or Modify Windows Event Log

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Potential EventLog File Location Tampering
id: 0cb8d736-995d-4ce7-a31e-1e8d452a1459
status: test
description: Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting
references:
    - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key
author: D3F7A5105
date: 2023-01-02
modified: 2023-08-17
tags:
    - attack.defense-impairment
    - attack.t1685.001
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SYSTEM\CurrentControlSet\Services\EventLog\'
        TargetObject|endswith: '\File'
    filter:
        Details|contains: '\System32\Winevt\Logs\'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    TargetObject|contains: '\SYSTEM\CurrentControlSet\Services\EventLog\'
    TargetObject|endswith: '\File'

Stage 2: `not filter`

filter:
    Details|contains: '\System32\Winevt\Logs\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Details`	match	`\System32\Winevt\Logs\`	`excludes:Details` `field:"Details" value:"\System32\Winevt\Logs\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`\File`	`field:"TargetObject" kind:ends_with value:"\File"`
`TargetObject`	match	`\SYSTEM\CurrentControlSet\Services\EventLog\` corpus 2 (sigma 2)	`field:"TargetObject" kind:match value:"\SYSTEM\CurrentControlSet\Services\EventLog\"`