---
title: Hunting for MiniNt security audit block in registry
description: Another day in the Advanced Hunting feature.I was told about a twitter post which explained it’s possible to block Security events from being created.If you add CurrentControlSetContro...
---

[Onevinn blog ](https://www.onevinn.com/blog)

# [Hunting for MiniNt security audit block in registry](https://www.onevinn.com/blog/hunting-for-minint-security-audit-block-in-registry)

 Written by [Security Labs - Stefan och Mattias](https://www.onevinn.com/blog/author/security-labs) | 15 Oct 2019

Another day in the Advanced Hunting feature.

I was told about a twitter post which explained it’s possible to block Security events from being created.

> If you add CurrentControlSetControlMiniNt key, the Windows will think it is WinPE and will not log any event to the Security Log 😱[#hacked](https://twitter.com/hashtag/hacked?src=hash&ref_src=twsrc%5Etfw) [#windowsinternals](https://twitter.com/hashtag/windowsinternals?src=hash&ref_src=twsrc%5Etfw) [#redteam](https://twitter.com/hashtag/redteam?src=hash&ref_src=twsrc%5Etfw)
> 
> — Grzegorz Tworek (@0gtweet) [October 11, 2019](https://twitter.com/0gtweet/status/1182516740955226112?ref_src=twsrc%5Etfw)

If the following key is added:  
***HKLM\System\CurrentControlSet\Control\MiniNt***

 Event Viewer after the registry key was added and after a reboot

Since it’s registry we have a lot of data to query in the Defender ATP portal ([https://securitycenter.windows.com](https://securitycenter.windows.com))

The Hunting query will be as follows

```
// Mattias Borg
// @mattiasborg82
RegistryEvents 
| where (RegistryKey  == "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNt") or
        (RegistryKey  == "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MiniNt")
| sort by EventTime desc
| project EventTime, ComputerName, RegistryKey, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessSHA1
```

This is the initial hunting query and might be changed to avoid False-Positives if there are any.

To be able to create a custom detection rule we need to add “MachineId” and “ReportId” to the output.

```
// Mattias Borg
// @mattiasborg82
RegistryEvents 
| where (RegistryKey  == "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNt") or
        (RegistryKey  == "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MiniNt")
| sort by EventTime desc
| project EventTime, ComputerName, RegistryKey, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessSHA1, MachineId, ReportId 
```

Click on “Create a detection rule”

Fill in the form and select your preferred actions

Happy Hunting!

[View full post](https://www.onevinn.com/blog/hunting-for-minint-security-audit-block-in-registry)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Security Labs - Stefan och Mattias"
  },
  "dateModified" : "2020-08-18T13:09:53.886Z",
  "datePublished" : "2019-10-15T11:37:52Z",
  "headline" : "Hunting for MiniNt security audit block in registry",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://www.onevinn.com/blog/hunting-for-minint-security-audit-block-in-registry",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Onevinn blog"
  }
}
```