Impair Defenses: Disable Windows Event Logging

Created the Tuesday 07 February 2023. Updated 9 months ago.

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more. This data is used by security tools and analysts to generate detections.

The EventLog service maintains event logs from various system components and applications. By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings. auditpol.exe may also be used to set audit policies.

Adversaries may target system-wide logging or just that of a particular application. For example, the EventLog service may be disabled using the following PowerShell line: Stop-Service -Name EventLog. Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. For example, auditpol /set /category:"Account Logon" /success:disable /failure:disable turns off auditing for the Account Logon category. To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.

Technique Identifier

T1562.002

Technique Tags

Defense Evasion event disabling EventLog service Local Security Policy (secpol.msc) auditpol.exe /success parameters /failure parameters Stop-Service -Name EventLog auditpol /clear /y auditpol /remove /allusers Security Settings\Local Policies\Audit Policy Security Settings\Advanced Audit Policy Configuration APT29

Code Snippets

# Disable Windows Event Log through service
sc config eventlog start=disabled
# Disable each Windows Event Log Category through auditpool
auditpol /set /category:"Account Logon" /success:disable /failure:disable
auditpol /set /category:"Detailed Tracking" /success:disable /failure:disable
# Clear and Disable all Categories
auditpol /clear /y
auditpol /remove /allusers
# Disable Windows Event Log Category through wevtutil
wevtutil sl Security /e:false
# Disable Windows Event Log thourgh Regitry Log Channels
reg add "HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\<anychannel>" /v Enabled /t REG_DWORD /d 0 /f

About Author Open Snippet

Author: 0x0d4y / Target Platform: Windows

Set-Service -Name EventLog -Status Stopped

About Author Open Snippet

Author: 0x0d4y / Target Platform: Windows

Detection Rules

title: Impair Defenses Through Disable Windows Event Logging was Detected
description: Detects the Impair Defenses tatic, through disable windows event logging technique
date : 04/12/2024
author: 0x0d4y
references:
- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
- https://attack.mitre.org/techniques/T1562/002/
tags:
- attack.defense.evasion
- attack.T1562.002
- malware.generic
logsource:
      category: process_creation, powershell_cmdlet, regitry_modification
      product: windows
detection:
    selection1:
        EventID:
            - '4688'
            - '1'
        NewProcessName:
            - 'sc.exe'    
        CommandLine|contains:
            - '*eventlog start=disabled*'
    selection2:
        EventID:
            - '4688'
            - '1'
        NewProcessName:
            - 'auditpol.exe'
        CommandLine|contains:
            - '*/success:disable*'
            - '*/clear*'
            - '*/remove*'
    selection3:
        EventID:
            - '4688'
            - '1'
        NewProcessName:
            - 'wevtutil.exe'
        CommandLine|contains:
            - '*sl*'
    selection4:
        EventID:
            - '4688'
            - '1'
        NewProcessName:
            - 'reg.exe'
        CommandLine|contains:
            - '*add*SOFTWARE\\Windows\\CurrentVersion\\WINEVT\\Channels\\*REG_DWORD /d 0*'
    selection5:
        EventID:
            - '13'
            - '4657'
        TargetRegistry|contains:
            - '*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\*'
        Details:
            - 0
            - 0x00000000
    selection6:
        EventID:
            - '4104'
        Message|contains:
            - '*Set-Service -Name EventLog -Status Stopped*'
      condition: selection1 or selection2 or selection3 or selection4 or selection5 or selection6
level: critical

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.