TA0005 · DEFENSE EVASION
Disable Windows Event Logging
Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.
Detect it with
Monitor processes and command-line arguments for commands that can be used to disable logging. For example, Wevtutil, auditpol, sc stop EventLog, and offensive tooling (such as Mimikatz and Invoke-Phant0m) may be used to clear logs.
Why it matters on shift
Disable Windows Event Logging is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context