T1685.001sub-technique of T1685 Disable or Modify Tools
Disable or Modify Windows Event Log
Windowsnothing on this site yetT1685.001 on attack.mitre.org
Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user and system activity such as login attempts and process creation. This data is used by security tools and analysts to generate detections. The EventLog service maintains event logs from various system components and applications. By default, the service automatically starts when a system powers on.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
how MITRE says to see it
Detect Disabled Windows Event Log
- Detection of attempts to disable or tamper with Windows Event Logging. This includes stopping or disabling the EventLog service, modifying registry keys related to EventLog and Autologger, using `auditpol` or `wevtutil` to disable categories or clear audit policies, and detecting suspicious gaps or resets in event...
what reduces it
- M1018 User Account Management. Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with logging.
- M1022 Restrict File and Directory Permissions. Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with logging or deleting or modifying.evtx logging files. Ensure.evtx files, which are located at `C:\Windows\system32\Winevt\Logs`, have the proper file permissions for limited, legitimate access and audit policies for detection.
- M1024 Restrict Registry Permissions. Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering logging. The addition of the MiniNT registry key disables Event Viewer.
- M1047 Audit. Consider periodic review of `auditpol` settings for Administrator accounts and perform dynamic baselining on SIEM(s) to investigate potential malicious activity. Also ensure that the EventLog service and its threads are properly running.