Detection of EventLog Registry Security Descriptor Tampering

This threat involves the unauthorized modification of Security Descriptor Definition Language (SDDL) values within the Windows registry to impair event logging. By altering the 'ChannelAccess' value under the 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog<Channel>' registry key, adversaries can restrict read/write access to specific event channels. This effectively blinds security monitoring tools and incident responders by preventing the ingestion of security-critical logs, including those generated by EDR products or Windows native audit policies. This technique is a known component of defense evasion strategies, as documented in various ransomware campaigns such as LockBit, where blinding defenders is a prerequisite for subsequent malicious actions like lateral movement or file encryption. Monitoring registry modifications to these specific paths is critical for identifying tampering attempts early in the kill chain.

Attack Chain

1. Attacker gains administrative privileges on the target Windows host via credential theft or exploit.
2. Attacker identifies the target EventLog channel (e.g., Security, System, or Application) they wish to obscure.
3. Attacker uses command-line tools or native API calls to interact with the Windows Registry.
4. Attacker locates the registry subkey at 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog<Channel>'.
5. Attacker modifies the 'ChannelAccess' value using a malicious SDDL string designed to deny access to authorized accounts or service accounts.
6. The operating system applies the new security descriptor, immediately restricting access to the specified event logs.
7. Defensive tools (e.g., SIEM forwarders, EDR agents) lose the ability to read or ingest events from the tampered channel.
8. Attacker proceeds with further malicious activity, such as exfiltration or encryption, while logging remains suppressed.

Impact

Successful exploitation of this technique results in significant degradation of security visibility. By neutralizing event log ingestion, organizations lose the ability to detect and investigate ongoing malicious activity. This activity has been observed in ransomware operations, where it serves as a critical defense evasion step to ensure long-term persistence and minimize the risk of detection during the final stages of the attack.

Recommendation

• Enable Sysmon Event ID 13 logging to capture all registry set operations and alert on modifications to the 'ChannelAccess' registry value.
• Deploy the provided Sigma rule to your SIEM environment to monitor for registry changes targeting EventLog configuration paths.
• Establish a baseline for legitimate registry modifications by system administrators or security software to minimize false positives caused by OS updates or new security agents.
• Configure alerting for high-risk users or processes that attempt to modify registry keys under the 'Eventlog' hierarchy.