
title: Disable Security Events Logging Adding Reg Key MiniNt
author: Ilyas Ochkov, oscd.community
date: 2019/10/25
description: Detects the addition of a key 'MiniNt' to the registry. Upon a reboot,
  Windows Event Log service will stopped write events.
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject: HKLM\SYSTEM\CurrentControlSet\Control\MiniNt
  SELECTION_5:
    EventType: CreateKey
  SELECTION_6:
    NewName: HKLM\SYSTEM\CurrentControlSet\Control\MiniNt
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and ((SELECTION_4 and SELECTION_5)
    or SELECTION_6))
falsepositives:
- Unknown
fields:
- EventID
- Image
- TargetObject
- NewName
id: 919f2ef0-be2d-4a7a-b635-eb2b41fde044
level: high
logsource:
  category: registry_event
  product: windows
modified: 2019/11/13
references:
- https://twitter.com/0gtweet/status/1182516740955226112
status: experimental
tags:
- attack.defense_evasion
- attack.t1089
- attack.t1562.001
- attack.t1112
ruletype: SIGMA
