Windows Event Log Access Tampering Via Registry

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects changes to the Windows EventLog channel permission values by monitoring modifications to the Security Descriptor Definition Language (SDDL) string in the registry. Such modifications can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify an event log channel. This action can prevent users from accessing the event log channel via Event Viewer or utilities like "Get-EventLog" or "wevtutil".