Skip to content

Hide Navigation Hide TOC

Change Winevt Channel Access Permission Via Registry (7d9263bd-dc47-4a58-bc92-5474abab390c)

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.

Cluster A Galaxy A Cluster B Galaxy B Level
Change Winevt Channel Access Permission Via Registry (7d9263bd-dc47-4a58-bc92-5474abab390c) Sigma-Rules Disable Windows Event Logging - T1562.002 (4eb28bed-d11a-4641-9863-c2ac017d910a) Attack Pattern 1
Disable Windows Event Logging - T1562.002 (4eb28bed-d11a-4641-9863-c2ac017d910a) Attack Pattern Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern 2