ATT&CK coverage › Technique
Impair Defenses: Disable Windows Event Logging T1562.002
Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more. This data is used by security tools and analysts to generate detections.
Events covered
11 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 28 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (24 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (176 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 24 rules
- Audit Policy Tampering Via Auditpol
- Audit Policy Tampering Via NT Resource Kit Auditpol
- Change Winevt Channel Access Permission Via Registry
- Disable Security Events Logging Adding Reg Key MiniNt
- Disable Windows Event Logging Via Registry
- Disable Windows IIS HTTP Logging
- ETW Logging/Processing Option Disabled On IIS Server
- EVTX Created In Uncommon Location
- Filter Driver Unloaded Via Fltmc.EXE
- HackTool - SharpEvtMute DLL Load
- HackTool - SharpEvtMute Execution
- HackTool - SysmonEnte Execution
- HTTP Logging Disabled On IIS Server
- Important Windows Event Auditing Disabled
- New Module Module Added To IIS Server
- Potential EventLog File Location Tampering
- Potential Suspicious Activity Using SeCEdit
- Previously Installed IIS Module Was Removed
- Security Event Logging Disabled via MiniNt Registry Key - Process
- Security Event Logging Disabled via MiniNt Registry Key - Registry Set
- Suspicious Eventlog Clearing or Configuration Change Activity
- Suspicious Svchost Process Access
- Sysmon Driver Unloaded Via Fltmc.EXE
- Windows Event Auditing Disabled