{
  "type": "attack-pattern",
  "spec_version": "2.1",
  "id": "attack-pattern--4eb28bed-d11a-4641-9863-c2ac017d910a",
  "created": "2020-02-21T20:46:36.688Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": true,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T1562/002",
      "external_id": "T1562.002"
    },
    {
      "source_name": "Disable_Win_Event_Logging",
      "description": " dmcxblue. (n.d.). Disable Windows Event Logging. Retrieved September 10, 2021.",
      "url": "https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1562-impair-defenses/disable-windows-event-logging"
    },
    {
      "source_name": "def_ev_win_event_logging",
      "description": "Chandel, R. (2021, April 22). Defense Evasion: Windows Event Logging (T1562.002). Retrieved September 14, 2021.",
      "url": "https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/"
    },
    {
      "source_name": "EventLog_Core_Technologies",
      "description": "Core Technologies. (2021, May 24). Essential Windows Services: EventLog / Windows Event Log. Retrieved September 14, 2021.",
      "url": "https://www.coretechnologies.com/blog/windows-services/eventlog/"
    },
    {
      "source_name": "Audit_Policy_Microsoft",
      "description": "Daniel Simpson. (2017, April 19). Audit Policy. Retrieved September 13, 2021.",
      "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/audit-policy"
    },
    {
      "source_name": "Windows Log Events",
      "description": "Franklin Smith. (n.d.). Windows Security Log Events. Retrieved February 21, 2020.",
      "url": "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/"
    },
    {
      "source_name": "disable_win_evt_logging",
      "description": "Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.",
      "url": "https://ptylu.github.io/content/report/report.html?report=25"
    },
    {
      "source_name": "auditpol",
      "description": "Jason Gerend, et al. (2017, October 16). auditpol. Retrieved September 1, 2021.",
      "url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol"
    },
    {
      "source_name": "winser19_file_overwrite_bug_twitter",
      "description": "Naceri, A. (2021, November 7). Windows Server 2019 file overwrite bug. Retrieved April 7, 2022.",
      "url": "https://web.archive.org/web/20211107115646/https://twitter.com/klinix5/status/1457316029114327040"
    },
    {
      "source_name": "T1562.002_redcanaryco",
      "description": "redcanaryco. (2021, September 3). T1562.002 - Disable Windows Event Logging. Retrieved September 13, 2021.",
      "url": "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.002/T1562.002.md"
    },
    {
      "source_name": "Advanced_sec_audit_policy_settings",
      "description": "Simpson, D. et al. (2017, April 19). Advanced security audit policy settings. Retrieved September 14, 2021.",
      "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings"
    },
    {
      "source_name": "auditpol.exe_STRONTIC",
      "description": "STRONTIC. (n.d.). auditpol.exe. Retrieved September 9, 2021.",
      "url": "https://strontic.github.io/xcyclopedia/library/auditpol.exe-214E0EA1F7F7C27C82D23F183F9D23F1.html"
    },
    {
      "source_name": "evt_log_tampering",
      "description": "svch0st. (2020, September 30). Event Log Tampering Part 1: Disrupting the EventLog Service. Retrieved September 14, 2021.",
      "url": "https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2026-04-14T22:54:40.108Z",
  "name": "Disable Windows Event Logging",
  "description": "Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.\n\nThe EventLog service maintains event logs from various system components and applications.(Citation: EventLog_Core_Technologies) By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to <code>Security Settings\\Local Policies\\Audit Policy</code> for basic audit policy settings or <code>Security Settings\\Advanced Audit Policy Configuration</code> for advanced audit policy settings.(Citation: Audit_Policy_Microsoft)(Citation: Advanced_sec_audit_policy_settings) <code>auditpol.exe</code> may also be used to set audit policies.(Citation: auditpol)\n\nAdversaries may target system-wide logging or just that of a particular application. For example, the Windows EventLog service may be disabled using the <code>Set-Service -Name EventLog -Status Stopped</code> or <code>sc config eventlog start=disabled</code> commands (followed by manually stopping the service using <code>Stop-Service  -Name EventLog</code>).(Citation: Disable_Win_Event_Logging)(Citation: disable_win_evt_logging) Additionally, the service may be disabled by modifying the “Start” value in <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\EventLog</code> then restarting the system for the change to take effect.(Citation: disable_win_evt_logging)\n\nThere are several ways to disable the EventLog service via registry key modification. First, without Administrator privileges, adversaries may modify the \"Start\" value in the key <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-Security</code>, then reboot the system to disable the Security EventLog.(Citation: winser19_file_overwrite_bug_twitter) Second, with Administrator privilege, adversaries may modify the same values in <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-System</code> and <code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-Application</code> to disable the entire EventLog.(Citation: disable_win_evt_logging)\n\nAdditionally, adversaries may use <code>auditpol</code> and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the <code>/success</code> or <code>/failure</code> parameters. For example, <code>auditpol /set /category:”Account Logon” /success:disable /failure:disable</code> turns off auditing for the Account Logon category.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) To clear the audit policy, adversaries may run the following lines: <code>auditpol /clear /y</code> or <code>auditpol /remove /allusers</code>.(Citation: T1562.002_redcanaryco)\n\nBy disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "stealth"
    }
  ],
  "x_mitre_attack_spec_version": "3.2.0",
  "x_mitre_contributors": [
    "Prasanth Sadanala, Cigna Information Protection (CIP) - Threat Response Engineering Team",
    "Lucas Heiligenstein"
  ],
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "enterprise-attack"
  ],
  "x_mitre_is_subtechnique": true,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_platforms": [
    "Windows"
  ],
  "x_mitre_version": "1.4"
}