feat: Security Event Logging Disabled Via MiniNt Registry Key

[swachchhanda000]

Summary of the Pull Request

Security Event Logging Disabled Via MiniNt Registry Key

Changelog

new: Security Event Logging Disabled Via MiniNt Registry Key - Process
new: Security Event Logging Disabled Via MiniNt Registry Key - Registry Set

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[frack113]

LGTM

[Copilot]

Pull Request Overview

This PR adds security detection rules for identifying attempts to disable Windows Event Logging through the MiniNt registry key. The rules target a defense evasion technique where adversaries add the MiniNt registry key to stop the Windows Event Log service from writing events after a system reboot.

• Creates two new detection rules for the MiniNt registry key manipulation
• Updates an existing registry event rule with additional references and improved MITRE ATT&CK technique mapping
• Implements detection across process creation and registry modification event sources

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
registry_set_create_minint_key.yml	New rule detecting registry modifications adding the MiniNt key
registry_event_disable_security_events_logging_adding_reg_key_minint.yml	Updated existing rule with additional reference and corrected MITRE technique ID
proc_creation_win_event_logging_disable_via_key_minint.yml	New rule detecting process execution attempts to create the MiniNt registry key

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}