Technique Search Instance

HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 263,
    "key": "impair-defenses-disable-windows-event-logging",
    "unprotect_id": "T1562.002",
    "name": "Impair Defenses: Disable Windows Event Logging",
    "description": "Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more. This data is used by security tools and analysts to generate detections.\r\n\r\nThe EventLog service maintains event logs from various system components and applications. By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\\Local Policies\\Audit Policy for basic audit policy settings or Security Settings\\Advanced Audit Policy Configuration for advanced audit policy settings. auditpol.exe may also be used to set audit policies.\r\n\r\nAdversaries may target system-wide logging or just that of a particular application. For example, the EventLog service may be disabled using the following PowerShell line: Stop-Service -Name EventLog. Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. For example, auditpol /set /category:\"Account Logon\" /success:disable /failure:disable turns off auditing for the Account Logon category. To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.",
    "windows": "",
    "linux": "",
    "macos": "",
    "resources": "https://attack.mitre.org/techniques/T1562/002/\r\nhttps://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/\r\nhttps://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/",
    "creation_date": "2023-02-07T00:12:57.052000Z",
    "tags": "Defense Evasion,\r\nevent disabling,\r\nEventLog service,\r\nLocal Security Policy (secpol.msc),\r\nauditpol.exe,\r\n/success parameters,\r\n/failure parameters,\r\nStop-Service -Name EventLog,\r\nauditpol /clear /y,\r\nauditpol /remove /allusers,\r\nSecurity Settings\\Local Policies\\Audit Policy,\r\nSecurity Settings\\Advanced Audit Policy Configuration,\r\nAPT29,",
    "modification_date": "2024-08-17T16:17:02.697023Z",
    "category": [
        10
    ],
    "rules": [
        159
    ],
    "attachments": [],
    "featured_api": [],
    "contributors": []
}