From a074de0337ebf862805cb01475b0663b12ff9381 Mon Sep 17 00:00:00 2001
From: ThisIsNotTheUserYouAreLookingFor <vangoethempieter@gmail.com>
Date: Wed, 9 Sep 2020 13:16:39 +0200
Subject: [PATCH] Update sysmonconfig-export.xml

add MiniNT regkey check
---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index f6688b3f..d1125fd2 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -561,6 +561,7 @@
 				<!--ADDITIONAL REFERENCE: [ http://www.silentrunners.org/launchpoints.html ] -->
 				<!--ADDITIONAL REFERENCE: [ https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2 ] -->
 				<!--ADDITIONAL REFERENCE: [ https://web.archive.org/web/20200116001643/http://scholarworks.rit.edu/cgi/viewcontent.cgi?article=1533&context=theses | Understanding malware autostart techniques - Matthew Gottlieb ] -->
+			<TargetObject name="T1562.002" condition="end with">\MiniNT</TargetObject> <!--Windows: Disable eventlog by acting like WinPE [https://twitter.com/0gtweet/status/1182516740955226112]  --> 
 			<TargetObject name="T1060,RunKey" condition="contains">CurrentVersion\Run</TargetObject> <!--Windows: Wildcard for Run keys, including RunOnce, RunOnceEx, RunServices, RunServicesOnce [Also covers terminal server] -->
 			<TargetObject name="T1060,RunPolicy" condition="contains">Policies\Explorer\Run</TargetObject> <!--Windows: Alternate runs keys | Credit @ion-storm-->
 			<TargetObject name="T1484" condition="contains">Group Policy\Scripts</TargetObject> <!--Windows: Group policy scripts-->