ETW Integrity Hunting Tip: Microsoft-Windows-Security-Auditing publisher

*" One thing that I stumbled upon which I haven't seen before was if I messed with the registry key associated with Microsoft-Windows-Security-Auditing publisher, I could stop the security log from logging those pesky 4688s and 4624s even after a reboot without disabling the EventLog Service. In this case, our detection opportunity is now EID 1108 and 1107 (depending on the version of Windows) in the Security log.*


*So if you find those EID's in your environment, check Sec publisher …

auditing blueteamsec case detection eid eventlog eventlog service find hunting integrity key log logging microsoft opportunity publisher reboot registry registry key security service version windows