Disable Security Events Logging Adding Reg Key MiniNt

Title: Disable Security Events Logging Adding Reg Key MiniNt
Status: test
Description:Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.
References:
  -https://twitter.com/0gtweet/status/1182516740955226112
  -https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
Author: Ilyas Ochkov, oscd.community
Date: 2019-10-25
modified:2021-11-27
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1685.001'
• -'attack.t1112'
• -'car.2022-03-001'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection:
TargetObject:'HKLM\SYSTEM\CurrentControlSet\Control\MiniNt' EventType:'CreateKey' NewName:'HKLM\SYSTEM\CurrentControlSet\Control\MiniNt'   condition:selection
Falsepositives:
  -Unknown
Level: high