type: attack-pattern
spec_version: 2.1
id: attack-pattern--4eb28bed-d11a-4641-9863-c2ac017d910a
created: 2020-02-21T20:46:36.688Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1562/002
external_id: T1562.002
source_name: Disable_Win_Event_Logging
description:  dmcxblue. (n.d.). Disable Windows Event Logging. Retrieved September 10, 2021.
url: https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1562-impair-defenses/disable-windows-event-logging
source_name: def_ev_win_event_logging
description: Chandel, R. (2021, April 22). Defense Evasion: Windows Event Logging (T1562.002). Retrieved September 14, 2021.
url: https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
source_name: EventLog_Core_Technologies
description: Core Technologies. (2021, May 24). Essential Windows Services: EventLog / Windows Event Log. Retrieved September 14, 2021.
url: https://www.coretechnologies.com/blog/windows-services/eventlog/
source_name: Audit_Policy_Microsoft
description: Daniel Simpson. (2017, April 19). Audit Policy. Retrieved September 13, 2021.
url: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/audit-policy
source_name: Windows Log Events
description: Franklin Smith. (n.d.). Windows Security Log Events. Retrieved February 21, 2020.
url: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/
source_name: disable_win_evt_logging
description: Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.
url: https://ptylu.github.io/content/report/report.html?report=25
source_name: auditpol
description: Jason Gerend, et al. (2017, October 16). auditpol. Retrieved September 1, 2021.
url: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol
source_name: winser19_file_overwrite_bug_twitter
description: Naceri, A. (2021, November 7). Windows Server 2019 file overwrite bug. Retrieved April 7, 2022.
url: https://web.archive.org/web/20211107115646/https://twitter.com/klinix5/status/1457316029114327040
source_name: T1562.002_redcanaryco
description: redcanaryco. (2021, September 3). T1562.002 - Disable Windows Event Logging. Retrieved September 13, 2021.
url: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.002/T1562.002.md
source_name: Advanced_sec_audit_policy_settings
description: Simpson, D. et al. (2017, April 19). Advanced security audit policy settings. Retrieved September 14, 2021.
url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings
source_name: auditpol.exe_STRONTIC
description: STRONTIC. (n.d.). auditpol.exe. Retrieved September 9, 2021.
url: https://strontic.github.io/xcyclopedia/library/auditpol.exe-214E0EA1F7F7C27C82D23F183F9D23F1.html
source_name: evt_log_tampering
description: svch0st. (2020, September 30). Event Log Tampering Part 1: Disrupting the EventLog Service. Retrieved September 14, 2021.
url: https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:45.425Z
name: Disable Windows Event Logging
description: Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.

The EventLog service maintains event logs from various system components and applications.(Citation: EventLog_Core_Technologies) By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.(Citation: Audit_Policy_Microsoft)(Citation: Advanced_sec_audit_policy_settings) auditpol.exe may also be used to set audit policies.(Citation: auditpol)

Adversaries may target system-wide logging or just that of a particular application. For example, the Windows EventLog service may be disabled using the Set-Service -Name EventLog -Status Stopped or sc config eventlog start=disabled commands (followed by manually stopping the service using Stop-Service -Name EventLog).(Citation: Disable_Win_Event_Logging)(Citation: disable_win_evt_logging) Additionally, the service may be disabled by modifying the “Start” value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog then restarting the system for the change to take effect.(Citation: disable_win_evt_logging)

There are several ways to disable the EventLog service via registry key modification. First, without Administrator privileges, adversaries may modify the "Start" value in the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security, then reboot the system to disable the Security EventLog.(Citation: winser19_file_overwrite_bug_twitter) Second, with Administrator privilege, adversaries may modify the same values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application to disable the entire EventLog.(Citation: disable_win_evt_logging)

Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. For example, auditpol /set /category:”Account Logon” /success:disable /failure:disable turns off auditing for the Account Logon category.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.(Citation: T1562.002_redcanaryco)

By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Prasanth Sadanala, Cigna Information Protection (CIP) - Threat Response Engineering Team
Lucas Heiligenstein
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_version: 1.4