Detection of Event Log Disabling via WevtUtil

The utility wevtutil.exe is a legitimate Windows command-line tool used to manage event logs. Attackers, including those deploying ransomware like Ransom-X and Rhysida, frequently leverage this binary to disable logging channels during the post-exploitation phase. By disabling audit event logs, threat actors can mask their presence, prevent security products from generating telemetry, and impede post-incident forensic analysis. This TTP is a critical indicator of malicious activity, as legitimate administrative tasks rarely require disabling event log channels in this manner. Defenders must monitor process creation events to identify command-line arguments that explicitly set log channels to a disabled state.

Attack Chain

1. Attacker gains initial access or achieves sufficient privileges (e.g., local administrator or SYSTEM).
2. Attacker prepares for lateral movement or data exfiltration.
3. Attacker identifies the need to suppress security alerts to remain undetected.
4. Attacker executes wevtutil.exe via command prompt or PowerShell.
5. Attacker provides arguments to target specific event log channels (e.g., 'sl' or 'set-log').
6. Attacker provides the flag to disable the target log (e.g., '/e:false' or '/enabled:false').
7. The operating system disables the specified log channel, stopping further log generation.
8. Attacker proceeds with further malicious objectives while forensic auditing is silenced.

Impact

Successful execution of this tactic prevents the creation of security logs, rendering existing SIEM/EDR detection rules ineffective for the duration of the compromise. This creates a significant blind spot that allows adversaries to persist, exfiltrate data, or deploy ransomware without triggering automated response actions.

Recommendation

1. Deploy the Sigma rule provided below to monitor for suspicious command-line execution of wevtutil.exe.
2. Ensure endpoint logs (Sysmon Event ID 1 or Security Event ID 4688) are ingesting full command-line arguments and parent process information.
3. Review alerts generated by this rule for potential false positives from legitimate network administration or debugging activity.
4. Integrate the identified telemetry into the EDR/SIEM Endpoint data model using CIM normalization to facilitate consistent alerting.