Disable or Modify Tools: Disable or Modify Windows Event Log
- ID
- T1685.001
- Tactics
- TA0112 Defense Impairment
- Sub-technique of
- T1685 Disable or Modify Tools
- Platforms
- Windows
- Data sources
- Service Metadata, Application Log Content, Windows Registry Key Modification, Process Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user and system activity such as login attempts and process creation.[3] This data is used by security tools and analysts to generate detections.
The EventLog service maintains event logs from various system components and applications. By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.[4][5] auditpol.exe may also be used to set audit policies.[6]
Adversaries may target system-wide logging or just that of a particular application. For example, the Windows EventLog service may be disabled using the Set-Service -Name EventLog -Status Stopped or sc config eventlog start=disabled commands (followed by manually stopping the service using Stop-Service -Name EventLog). Additionally, the service may be disabled by modifying the "Start" value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog then restarting the system for the change to take effect.[7][8]
There are several ways to disable the EventLog service via registry key modification. Without Administrator privileges, adversaries may modify the "Start" value in the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security, then reboot the system to disable the Security EventLog.[9] With Administrator privilege, adversaries may modify the same values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application to disable the entire EventLog.
Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. For example, auditpol /set /category:"Account Logon" /success:disable /failure:disable turns off auditing for the Account Logon category.[10] To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.[11]
Detection
- DET0187 Detect Disabled Windows Event Log
Data components: Service Metadata, Application Log Content, Windows Registry Key Modification, Process Creation
Mitigations (4)
- M1018 User Account Management
Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with logging.
- M1022 Restrict File and Directory Permissions
Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with logging or deleting or modifying .evtx logging files. Ensure .evtx files, which are located at
C:\Windows\system32\Winevt\Logs[1], have the proper file permissions for limited, legitimate access and audit policies for detection.- M1024 Restrict Registry Permissions
Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering logging. The addition of the MiniNT registry key disables Event Viewer.[2]
- M1047 Audit
Consider periodic review of
auditpolsettings for Administrator accounts and perform dynamic baselining on SIEM(s) to investigate potential malicious activity. Also ensure that the EventLog service and its threads are properly running.