Windows Event Log Access Tampering Via Registry

Adversaries utilize registry modification techniques to impair security monitoring on Windows systems by altering the access permissions of specific Event Log channels. By modifying the Security Descriptor Definition Language (SDDL) strings associated with keys such as 'CustomSD' or 'ChannelAccess', attackers can effectively deny read or write access to authorized accounts or automated security tools. This defense impairment technique prevents security operations teams from viewing event logs via standard utilities like Event Viewer, wevtutil, or PowerShell's Get-EventLog cmdlet. This activity is often associated with post-exploitation phases where attackers aim to maintain persistence or cover their tracks by preventing the recording or auditing of malicious actions. Defenders should monitor registry modifications targeting Event Log configuration paths for unauthorized SDDL string changes.

Attack Chain

1. Attacker gains administrative access to the target Windows system.
2. Attacker identifies Event Log registry configurations under HKLM\SYSTEM\CurrentControlSet\Services\EventLog\ or HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels.
3. Attacker uses reg.exe or PowerShell to set the 'CustomSD' or 'ChannelAccess' registry values.
4. Attacker inserts a "Deny" access control entry into the SDDL string (e.g., D:(D;;0x1;;;WD)).
5. The registry change propagates, updating the security descriptor for the target log channel.
6. Legitimate users or automated monitoring services are denied access to the log channel.
7. Attacker executes further malicious activity, which remains hidden or inaccessible to defensive review.

Impact

Successful manipulation of Event Log access permissions directly degrades the visibility of the security operations team. This facilitates defense evasion, allowing attackers to perform subsequent malicious operations, such as lateral movement or data exfiltration, without leaving an audit trail that can be consumed by SIEM or EDR platforms.

Recommendation

1. Deploy the provided Sigma rule to detect modifications to Event Log registry keys.
2. Monitor registry modification events targeting 'CustomSD' or 'ChannelAccess' specifically for strings containing 'D:(D;'.
3. Validate detection logic using the referenced Atomic Red Team tests for T1562.002.
4. Ensure that system-level updates initiated by 'TrustedInstaller.exe' are correctly filtered to avoid false positives.