|T1562.001||Disable or Modify Tools|
|T1562.002||Disable Windows Event Logging|
|T1562.003||Impair Command History Logging|
|T1562.004||Disable or Modify System Firewall|
|T1562.007||Disable or Modify Cloud Firewall|
|T1562.008||Disable Cloud Logs|
|T1562.009||Safe Mode Boot|
Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more. This data is used by security tools and analysts to generate detections.
The EventLog service maintains event logs from various system components and applications. By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to
Security Settings\Local Policies\Audit Policy for basic audit policy settings or
Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.
auditpol.exe may also be used to set audit policies.
Adversaries may target system-wide logging or just that of a particular application. For example, the EventLog service may be disabled using the following PowerShell line:
Stop-Service -Name EventLog. Additionally, adversaries may use
auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the
/failure parameters. For example,
auditpol /set /category:"Account Logon" /success:disable /failure:disable turns off auditing for the Account Logon category. To clear the audit policy, adversaries may run the following lines:
auditpol /clear /y or
auditpol /remove /allusers.
By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.
Consider periodic review of
|M1022||Restrict File and Directory Permissions||
Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with logging or deleting or modifying .evtx logging files. Ensure .evtx files, which are located at
|M1024||Restrict Registry Permissions||
Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering logging. The addition of the MiniNT registry key disables Event Viewer.
|M1018||User Account Management||
Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with logging.
|ID||Data Source||Data Component||Detects|
|DS0015||Application Log||Application Log Content||
Monitor for third-party application logging, messaging, and/or other artifacts provided by third-party services that may disable Windows event logging to limit data that can be leveraged for detections and audits.
Monitor executed commands and arguments for commands that can be used to disable logging. For example, Wevtutil, auditpol, sc stop EventLog, and offensive tooling (such as Mimikatz and Invoke-Phant0m) may be used to clear logs.
Monitor newly executed processes that may disable Windows event logging to limit data that can be leveraged for detections and audits.
Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.
|DS0013||Sensor Health||Host Status||
Monitor for logging, messaging that may disable Windows event logging to limit data that can be leveraged for detections and audits.
|DS0024||Windows Registry||Windows Registry Key Creation||
Monitor the addition of the MiniNT registry key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control, which may disable Event Viewer.