Disable Windows Event and Security Logs Using Built-in Tools

Attackers may disable Windows event logs to evade detection and hide their activities. This involves using built-in Windows utilities such as logman.exe, PowerShell (powershell.exe, pwsh.exe, powershell_ise.exe), and auditpol.exe to stop or disable the EventLog service or specific event logs. Disabling logging can prevent defenders from detecting malicious activity and hinder incident response efforts. This activity is usually associated with post-exploitation behavior. The tools mentioned are legitimate Windows binaries, making it harder to distinguish malicious use from legitimate administration. This rule detects the abuse of these tools.

Attack Chain

1. The attacker gains initial access to the system (e.g., via phishing or exploit).
2. The attacker executes powershell.exe to disable the EventLog service using the Set-Service cmdlet with the Disabled parameter.
3. Alternatively, the attacker executes logman.exe to stop or delete specific EventLog traces, such as EventLog-*.
4. The attacker may use auditpol.exe with the /success:disable argument to disable auditing policies.
5. The attacker performs malicious activities, such as lateral movement, privilege escalation, or data exfiltration.
6. The attacker attempts to remove traces of their activity by deleting or disabling specific event logs using logman.exe.
7. The attacker leverages PowerShell to further impair defenses by disabling security features.
8. The attacker achieves their objective (e.g., data theft, system compromise) without being detected due to disabled logging.

Impact

Successful disabling of Windows event logs can severely hinder incident response and forensic investigations. It allows attackers to operate undetected, making it difficult to identify the scope of the compromise, the attacker's actions, and the data that was accessed or stolen. Without logs, security teams lose visibility into the attacker's activities, increasing dwell time and the potential for significant damage. Depending on the targeted system, impact could range from disabling logging on a single workstation to a domain controller affecting a whole environment.

Recommendation

• Deploy the Sigma rules in this brief to your SIEM to detect attempts to disable Windows event logging. Tune for your environment (see "Disable Windows Event and Security Logs Using Built-in Tools" rules).
• Monitor process creation events for the execution of logman.exe, powershell.exe, pwsh.exe, powershell_ise.exe, and auditpol.exe with arguments related to disabling event logs (process_creation logsource).
• Investigate any detected instances of these commands to determine if they are legitimate or malicious ("Disable Windows Event and Security Logs Using Built-in Tools" rules).
• Implement strict access controls and auditing policies to limit who can modify event logging configurations.