Change Winevt Channel Access Permission Via Registry
This rule detects attempts to modify the "ChannelAccess" registry key, which controls access permissions for Windows event channels. Adversaries may tamper with these permissions to prevent security tools or analysts from accessing event logs, thereby hindering detection and forensic analysis. The rule specifically looks for modifications to the 'ChannelAccess' key within the 'WINEVT\Channels' registry path and identifies specific Security Descriptor Definition Language (SDDL) strings that grant 'GENERIC ALL' or 'GENERIC WRITE' permissions to local administrators, local system, or built-in administrators. This activity is often a precursor to clearing event logs or otherwise impairing defenses.
Sigma
