Skip to content

T1562.002 Disable Windows Event Logging

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.1 This data is used by security tools and analysts to generate detections.

The EventLog service maintains event logs from various system components and applications.2 By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.34 auditpol.exe may also be used to set audit policies.5

Adversaries may target system-wide logging or just that of a particular application. For example, the EventLog service may be disabled using the following PowerShell line: Stop-Service -Name EventLog.6 Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. For example, auditpol /set /category:”Account Logon” /success:disable /failure:disable turns off auditing for the Account Logon category.78 To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.8

By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.

Item Value
ID T1562.002
Sub-techniques T1562.001, T1562.002, T1562.003, T1562.004, T1562.006, T1562.007, T1562.008, T1562.009, T1562.010
Tactics TA0005
Platforms Windows
Permissions required Administrator
Version 1.1
Created 21 February 2020
Last Modified 19 October 2021

Procedure Examples

ID Name Description
G0016 APT29 APT29 used AUDITPOL to prevent the collection of audit logs.15
G0034 Sandworm Team Sandworm Team has disabled event logging on compromised systems.13
G0027 Threat Group-3390 Threat Group-3390 has used appcmd.exe to disable logging on a victim server.14
S0645 Wevtutil Wevtutil can be used to disable specific event logs on the system.12

Mitigations

ID Mitigation Description
M1047 Audit Consider periodic review of auditpol settings for Administrator accounts and perform dynamic baselining on SIEM(s) to investigate potential malicious activity. Also ensure that the EventLog service and its threads are properly running.
M1022 Restrict File and Directory Permissions Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with logging or deleting or modifying .evtx logging files. Ensure .evtx files, which are located at C:\Windows\system32\Winevt\Logs11, have the proper file permissions for limited, legitimate access and audit policies for detection.
M1024 Restrict Registry Permissions Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering logging. The addition of the MiniNT registry key disables Event Viewer.9
M1018 User Account Management Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with logging.

Detection

ID Data Source Data Component
DS0015 Application Log Application Log Content
DS0017 Command Command Execution
DS0009 Process Process Creation
DS0012 Script Script Execution
DS0013 Sensor Health Host Status
DS0024 Windows Registry Windows Registry Key Creation

References

  1. Franklin Smith. (n.d.). Windows Security Log Events. Retrieved February 21, 2020. ↩

  2. Core Technologies. (2021, May 24). Essential Windows Services: EventLog / Windows Event Log. Retrieved September 14, 2021. ↩

  3. Daniel Simpson. (2017, April 19). Audit Policy. Retrieved September 13, 2021. ↩

  4. Simpson, D. et al. (2017, April 19). Advanced security audit policy settings. Retrieved September 14, 2021. ↩

  5. Jason Gerend, et al. (2017, October 16). auditpol. Retrieved September 1, 2021. ↩

  6. dmcxblue. (n.d.). Disable Windows Event Logging. Retrieved September 10, 2021. ↩

  7. STRONTIC. (n.d.). auditpol.exe. Retrieved September 9, 2021. ↩

  8. redcanaryco. (2021, September 3). T1562.002 - Disable Windows Event Logging. Retrieved September 13, 2021. ↩↩

  9. Chandel, R. (2021, April 22). Defense Evasion: Windows Event Logging (T1562.002). Retrieved September 14, 2021. ↩

  10. svch0st. (2020, September 30). Event Log Tampering Part 1: Disrupting the EventLog Service. Retrieved September 14, 2021. ↩

  11. Forensics Wiki. (2021, June 19). Windows XML Event Log (EVTX). Retrieved September 13, 2021. ↩

  12. Microsoft. (n.d.). wevtutil. Retrieved September 14, 2021. ↩

  13. Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020. ↩

  14. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017. ↩

  15. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021. ↩

Back to top