{'created': '2020-02-21T20:46:36.688Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may disable Windows event logging to limit data '
                'that can be leveraged for detections and audits. Windows '
                'event logs record user and system activity such as login '
                'attempts, process creation, and much more.(Citation: Windows '
                'Log Events) This data is used by security tools and analysts '
                'to generate detections.\n'
                '\n'
                'The EventLog service maintains event logs from various system '
                'components and applications.(Citation: '
                'EventLog_Core_Technologies) By default, the service '
                'automatically starts when a system powers on. An audit '
                'policy, maintained by the Local Security Policy (secpol.msc), '
                'defines which system events the EventLog service logs. '
                'Security audit policy settings can be changed by running '
                'secpol.msc, then navigating to <code>Security Settings\\Local '
                'Policies\\Audit Policy</code> for basic audit policy settings '
                'or <code>Security Settings\\Advanced Audit Policy '
                'Configuration</code> for advanced audit policy '
                'settings.(Citation: Audit_Policy_Microsoft)(Citation: '
                'Advanced_sec_audit_policy_settings) <code>auditpol.exe</code> '
                'may also be used to set audit policies.(Citation: auditpol)\n'
                '\n'
                'Adversaries may target system-wide logging or just that of a '
                'particular application. For example, the Windows EventLog '
                'service may be disabled using the <code>Set-Service -Name '
                'EventLog -Status Stopped</code> or <code>sc config eventlog '
                'start=disabled</code> commands (followed by manually stopping '
                'the service using <code>Stop-Service  -Name '
                'EventLog</code>).(Citation: '
                'Disable_Win_Event_Logging)(Citation: disable_win_evt_logging) '
                'Additionally, the service may be disabled by modifying the '
                '“Start” value in '
                '<code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\EventLog</code> '
                'then restarting the system for the change to take '
                'effect.(Citation: disable_win_evt_logging)\n'
                '\n'
                'There are several ways to disable the EventLog service via '
                'registry key modification. First, without Administrator '
                'privileges, adversaries may modify the "Start" value in the '
                'key '
                '<code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-Security</code>, '
                'then reboot the system to disable the Security '
                'EventLog.(Citation: winser19_file_overwrite_bug_twitter) '
                'Second, with Administrator privilege, adversaries may modify '
                'the same values in '
                '<code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-System</code> '
                'and '
                '<code>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-Application</code> '
                'to disable the entire EventLog.(Citation: '
                'disable_win_evt_logging)\n'
                '\n'
                'Additionally, adversaries may use <code>auditpol</code> and '
                'its sub-commands in a command prompt to disable auditing or '
                'clear the audit policy. To enable or disable a specified '
                'setting or audit category, adversaries may use the '
                '<code>/success</code> or <code>/failure</code> parameters. '
                'For example, <code>auditpol /set /category:”Account Logon” '
                '/success:disable /failure:disable</code> turns off auditing '
                'for the Account Logon category.(Citation: '
                'auditpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) To '
                'clear the audit policy, adversaries may run the following '
                'lines: <code>auditpol /clear /y</code> or <code>auditpol '
                '/remove /allusers</code>.(Citation: T1562.002_redcanaryco)\n'
                '\n'
                'By disabling Windows event logging, adversaries can operate '
                'while leaving less evidence of a compromise behind.',
 'external_references': [{'external_id': 'T1562.002',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1562/002'},
                         {'description': ' dmcxblue. (n.d.). Disable Windows '
                                         'Event Logging. Retrieved September '
                                         '10, 2021.',
                          'source_name': 'Disable_Win_Event_Logging',
                          'url': 'https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1562-impair-defenses/disable-windows-event-logging'},
                         {'description': 'Chandel, R. (2021, April 22). '
                                         'Defense Evasion: Windows Event '
                                         'Logging (T1562.002). Retrieved '
                                         'September 14, 2021.',
                          'source_name': 'def_ev_win_event_logging',
                          'url': 'https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/'},
                         {'description': 'Core Technologies. (2021, May 24). '
                                         'Essential Windows Services: EventLog '
                                         '/ Windows Event Log. Retrieved '
                                         'September 14, 2021.',
                          'source_name': 'EventLog_Core_Technologies',
                          'url': 'https://www.coretechnologies.com/blog/windows-services/eventlog/'},
                         {'description': 'Daniel Simpson. (2017, April 19). '
                                         'Audit Policy. Retrieved September '
                                         '13, 2021.',
                          'source_name': 'Audit_Policy_Microsoft',
                          'url': 'https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/audit-policy'},
                         {'description': 'Franklin Smith. (n.d.). Windows '
                                         'Security Log Events. Retrieved '
                                         'February 21, 2020.',
                          'source_name': 'Windows Log Events',
                          'url': 'https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/'},
                         {'description': 'Heiligenstein, L. (n.d.). REP-25: '
                                         'Disable Windows Event Logging. '
                                         'Retrieved April 7, 2022.',
                          'source_name': 'disable_win_evt_logging',
                          'url': 'https://ptylu.github.io/content/report/report.html?report=25'},
                         {'description': 'Jason Gerend, et al. (2017, October '
                                         '16). auditpol. Retrieved September '
                                         '1, 2021.',
                          'source_name': 'auditpol',
                          'url': 'https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol'},
                         {'description': 'Naceri, A. (2021, November 7). '
                                         'Windows Server 2019 file overwrite '
                                         'bug. Retrieved April 7, 2022.',
                          'source_name': 'winser19_file_overwrite_bug_twitter',
                          'url': 'https://web.archive.org/web/20211107115646/https://twitter.com/klinix5/status/1457316029114327040'},
                         {'description': 'redcanaryco. (2021, September 3). '
                                         'T1562.002 - Disable Windows Event '
                                         'Logging. Retrieved September 13, '
                                         '2021.',
                          'source_name': 'T1562.002_redcanaryco',
                          'url': 'https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.002/T1562.002.md'},
                         {'description': 'Simpson, D. et al. (2017, April 19). '
                                         'Advanced security audit policy '
                                         'settings. Retrieved September 14, '
                                         '2021.',
                          'source_name': 'Advanced_sec_audit_policy_settings',
                          'url': 'https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings'},
                         {'description': 'STRONTIC. (n.d.). auditpol.exe. '
                                         'Retrieved September 9, 2021.',
                          'source_name': 'auditpol.exe_STRONTIC',
                          'url': 'https://strontic.github.io/xcyclopedia/library/auditpol.exe-214E0EA1F7F7C27C82D23F183F9D23F1.html'},
                         {'description': 'svch0st. (2020, September 30). Event '
                                         'Log Tampering Part 1: Disrupting the '
                                         'EventLog Service. Retrieved '
                                         'September 14, 2021.',
                          'source_name': 'evt_log_tampering',
                          'url': 'https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c'}],
 'id': 'attack-pattern--4eb28bed-d11a-4641-9863-c2ac017d910a',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'defense-evasion'}],
 'modified': '2025-10-24T17:48:45.425Z',
 'name': 'Disable Windows Event Logging',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Prasanth Sadanala, Cigna Information Protection '
                          '(CIP) - Threat Response Engineering Team',
                          'Lucas Heiligenstein'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows'],
 'x_mitre_version': '1.4'}

---