Change Winevt Channel Access Permission Via Registry

Last updated on:

Applies to: Log360Log360 Cloud

About the rule

Rule Type

Standard

Rule Description

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.

Severity

Trouble

Rule Requirement

Criteria

Action1: actionname = "Registry value modified" AND ((OBJECTNAME contains "\Microsoft\Windows\CurrentVersion\WINEVT\Channels" OR (OBJECTNAME endswith "\Microsoft\Windows\CurrentVersion\WINEVT\Channels" AND isExist(OBJECTVALUENAME))) AND OBJECTNAME endswith "\ChannelAccess" AND INFORMATION contains "(A;;0x1;;;LA),(A;;0x1;;;SY),(A;;0x5;;;BA)") AND (PROCESSNAME != "C:\Windows\servicing\TrustedInstaller.exe" AND (PROCESSNAME notstartswith "C:\Windows\WinSxS" OR PROCESSNAME notendswith "\TiWorker.exe")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES,Action1.USERNAME,Action1.DOMAIN,Action1.NEWTYPE,Action1.OBJECTVALUENAME,Action1.OLDTYPE

Detection

Execution Mode

realtime

Log Sources

Windows

Author

frack113