Change Winevt Channel Access Permission Via Registry

Title: Change Winevt Channel Access Permission Via Registry
Status: test
Description:Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.
References:
  -https://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/
  -https://learn.microsoft.com/en-us/windows/win32/api/winevt/
  -https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
Author: frack113
Date: 2022-09-17
modified:2024-03-25
Tags:

• -'attack.defense-impairment'
• -'attack.t1685.001'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: '\Microsoft\Windows\CurrentVersion\WINEVT\Channels\'
    TargetObject|endswith: '\ChannelAccess'
    Details|contains:
      -'(A;;0x1;;;LA)'
      -'(A;;0x1;;;SY)'
      -'(A;;0x5;;;BA)'

  filter_main_trustedinstaller:
    Image: 'C:\Windows\servicing\TrustedInstaller.exe'
  filter_main_tiworker:
    Image|startswith: 'C:\Windows\WinSxS\'
    Image|endswith: '\TiWorker.exe'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high