Detecting Disabled or Modified Windows Event Log (T1685.001)

Disable or Modify Windows Event Log (T1685.001) is a sub-technique of Disable or Modify Tools. Adversaries disable or change the Windows Event Log to limit the data that detections and audits rely on. MITRE lists the Defense Impairment tactic and Windows as the platform.

Windows Event Log records user and system activity, including logon attempts and process creation. Security tools and analysts build detections on that data, so removing it removes the evidence.

How attackers use it

MITRE describes the EventLog service, which starts automatically at boot. An audit policy, managed through the Local Security Policy (secpol.msc), defines which events get logged. The policy can be changed in the console under Local Policies for basic settings or under Advanced Audit Policy Configuration for finer control, and auditpol.exe can also set it.

An adversary may target system-wide logging or the logs of one application. MITRE's examples include:

• Stopping and disabling the EventLog service with PowerShell (Set-Service, Stop-Service) or sc config.
• Changing the "Start" value of the EventLog service in the Registry, then restarting the system for the change to take effect.
• Changing the "Start" value of the EventLog-Security Autologger key under the WMI Autologger path. MITRE notes that without Administrator privileges, an adversary may be able to do this and reboot to disable the Security event log.

Documented uses include disabled event logging on compromised systems, deleted Windows event and application logs, scripts that disable the event log service, use of AUDITPOL to stop audit collection, and use of appcmd.exe to turn off logging on a server.

How to detect it

MITRE's detection strategy covers several signals:

• Stopping or disabling the EventLog service.
• Registry changes to the EventLog and Autologger keys.
• Use of auditpol or wevtutil to disable categories or clear audit policy.
• Suspicious gaps or resets in the sequence of event records.

The last one matters because a disabled log leaves no direct trace of its own removal on that host. A gap in record numbers, or a host that goes silent in your central store right after a privileged logon, is a strong lead.

Windows has built-in events for some of these changes. Event ID 4719 records a change to audit policy, and Event ID 1102 records that the Security log was cleared. Collect them centrally.

How to reduce the risk

MITRE lists four mitigations.

1. User Account Management. Make sure permissions prevent adversaries from disabling or interfering with logging.
2. Audit. Review auditpol settings for Administrator accounts periodically, baseline activity in your SIEM, and confirm the EventLog service and its threads run properly.
3. Restrict Registry Permissions. Protect the keys that control logging. MITRE notes that adding the MiniNT registry key disables Event Viewer.
4. Restrict File and Directory Permissions. Protect .evtx files, found in C:\Windows\system32\Winevt\Logs, with limited access and audit policies for detection.

The strongest control is not on the host at all. Forward events off the machine as they occur, so an attacker with local rights cannot reach the copy.

Check your own environment

These are read-only commands. Run them in an elevated session on Windows.

Get-Service -Name EventLog
auditpol /get /category:*
wevtutil gl Security

The first shows whether the service is running. The second shows the audit policy by category. The third shows the Security log configuration, including its maximum size and whether it is enabled.

Then check:

• Does each category you rely on, such as logon and process creation, show the setting you expect?
• Are logs forwarded to a central collector, and how many seconds behind is it?
• Do you alert when the EventLog service stops or audit policy changes?
• Who can edit the EventLog Registry keys and the Winevt log folder?

Quick check

Sources

• MITRE ATT&CK, Disable or Modify Windows Event Log (T1685.001): https://attack.mitre.org/techniques/T1685/001