T1685.001Defense Impairment
Disable or Modify Windows Event Log
Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user and system activity such as login attempts and process creation. This data is used by security tools and analysts to generate detections. The EventLog service maintains event logs from various system components and applications. By default, the…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
28 Sigma rules tagged T1685.001Disable or Modify Windows Event LogT1685.00128 general rules
- Suspicious Eventlog Clearing or Configuration Change Activityhighstable
- Audit Policy Tampering Via Auditpolhightest
- Audit Policy Tampering Via NT Resource Kit Auditpolhightest
- Change Winevt Channel Access Permission Via Registryhightest
- Disable Security Events Logging Adding Reg Key MiniNthightest
- Disable Windows Event Logging Via Registryhightest
- Disable Windows IIS HTTP Logginghightest
- Forest Blizzard APT - File Creation Activityhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Disable or Modify Windows Event Log
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.