T1685.001 Disable or Modify Windows Event Log — ATT&CK Technique
Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user and system activity such as login attempts and process creation. This data is used by security tools and analysts to generate detections. The EventLog service maintains event logs from various system components and applications. By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to `Security Settings\Local Policies\Audit Policy` for basic audit policy settings or `Security Settings\Advanced Audit Policy Configuration` for advanced audit policy settings. `auditpol.exe` may also be used to set audit policies. Adversaries may target system-wide logging or just that of a particular application. For example, the Windows EventLog service may be disabled using the `Set-Service -Name EventLog -Status Stopped` or `sc config eventlog start=disabled` commands (followed by manually stopping the service using `Stop-Service -Name EventLog`). Additionally, the service may be disabled by modifying the "Start" value in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog` then restarting the system for the change to take effect. There are several ways to disable the EventLog service via registry key modification. Without Administrator privileges, adversaries may modify the "Start" value in the key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security`, then reboot the system to disable the Security EventLog. With Administrator privilege, adversaries may modify the same values in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System` and `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application` to disable the entire EventLog. Additionally, adversaries may use `auditpol` and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the `/success` or `/failure` parameters. For example, `auditpol /set /category:"Account Logon" /success:disable /failure:disable` turns off auditing for the Account Logon category. To clear the audit policy, adversaries may run the following lines: `auditpol /clear /y` or `auditpol /remove /allusers`.
Detection coverage (41)
- Forest Blizzard APT - JavaScript Constrained File Creation medium
- Forest Blizzard APT - File Creation Activity high
- Previously Installed IIS Module Was Removed low
- ETW Logging/Processing Option Disabled On IIS Server medium
- New Module Module Added To IIS Server medium
- HTTP Logging Disabled On IIS Server high
- Windows Event Auditing Disabled low
- Important Windows Event Auditing Disabled high
- EVTX Created In Uncommon Location medium
- HackTool - SharpEvtMute DLL Load high
- Suspicious Svchost Process Access high
- HackTool - SysmonEnte Execution high
- Windows EventLog Autologger Session Registry Modification Via CommandLine high
- Audit Policy Tampering Via Auditpol high
- Audit Policy Tampering Via NT Resource Kit Auditpol high
- Security Event Logging Disabled via MiniNt Registry Key - Process high
- Sysmon Driver Unloaded Via Fltmc.EXE high
- Filter Driver Unloaded Via Fltmc.EXE medium
- HackTool - SharpEvtMute Execution high
- Disable Windows IIS HTTP Logging high
- Potential Suspicious Activity Using SeCEdit medium
- Suspicious Eventlog Clearing or Configuration Change Activity high
- Disable Security Events Logging Adding Reg Key MiniNt high
- Change Winevt Channel Access Permission Via Registry high
- Security Event Logging Disabled via MiniNt Registry Key - Registry Set high
- Potential AutoLogger Sessions Tampering high
- Disable Windows Event Logging Via Registry high
- Potential EventLog File Location Tampering high
- Cisco ASA - Logging Message Suppression
- Windows Audit Policy Cleared via Auditpol
- Windows Audit Policy Excluded Category via Auditpol
- Windows Audit Policy Auditing Option Disabled via Auditpol
- Windows Audit Policy Disabled via Auditpol
- Windows Audit Policy Restored via Auditpol
- Windows Audit Policy Disabled via Legacy Auditpol
- Windows Audit Policy Security Descriptor Tampering via Auditpol
- Windows Disable Windows Event Logging Disable HTTP Logging
- Windows Global Object Access Audit List Cleared Via Auditpol
- Windows New Custom Security Descriptor Set On EventLog Channel
- Windows New EventLog ChannelAccess Registry Value Set
- Windows PowerShell Disable HTTP Logging