{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/eventlog/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Microsoft Defender XDR","Elastic Defend","SentinelOne Cloud Funnel"],"_cs_severities":["medium"],"_cs_tags":["defense-evasion","windows","eventlog"],"_cs_type":"advisory","_cs_vendors":["Microsoft","Elastic","SentinelOne","Crowdstrike"],"content_html":"\u003cp\u003eAttackers often disable Windows Event and Security Logs to evade detection on compromised systems. This activity involves tampering with, clearing, and deleting event log data to break SIEM detections, cover their tracks, and slow down incident response. The methods employed include using the \u003ccode\u003elogman\u003c/code\u003e utility, PowerShell commands to disable the EventLog service, or \u003ccode\u003eauditpol\u003c/code\u003e to disable auditing. These actions are typically performed after initial access and privilege escalation to hinder forensic investigations and maintain persistence within the environment. Defenders should monitor for these specific tools and command-line arguments to identify potential attempts to disable logging.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial access to the system, possibly through phishing or exploiting a vulnerability.\u003c/li\u003e\n\u003cli\u003eThe attacker escalates privileges to administrator level to gain the necessary permissions to modify event logging settings.\u003c/li\u003e\n\u003cli\u003eThe attacker uses \u003ccode\u003elogman.exe\u003c/code\u003e with arguments to stop or delete EventLog traces (e.g., \u003ccode\u003elogman.exe stop EventLog-*\u003c/code\u003e, \u003ccode\u003elogman.exe delete EventLog-*\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAlternatively, the attacker uses PowerShell with \u003ccode\u003eSet-Service\u003c/code\u003e cmdlet to disable the EventLog service (e.g., \u003ccode\u003epowershell.exe Set-Service EventLog -StartupType Disabled\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker can also use \u003ccode\u003eauditpol.exe\u003c/code\u003e to disable auditing policies, preventing future events from being logged (e.g., \u003ccode\u003eauditpol.exe /success:disable\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAfter disabling logging, the attacker performs malicious activities such as lateral movement, data exfiltration, or malware deployment, with a reduced risk of detection.\u003c/li\u003e\n\u003cli\u003eThe attacker removes traces of their activity from other logs if possible.\u003c/li\u003e\n\u003cli\u003eThe attacker maintains persistence and continues to exploit the compromised environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful disabling of Windows Event and Security Logs can severely hinder incident response and forensic investigations. The absence of log data makes it difficult to detect ongoing malicious activity, understand the scope of the compromise, and attribute the attack. This can lead to prolonged dwell time for attackers, increased data exfiltration, and greater overall damage to the organization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Disable Windows Event and Security Logs Using Built-in Tools\u0026rdquo; to your SIEM to detect the execution of \u003ccode\u003elogman.exe\u003c/code\u003e, PowerShell, and \u003ccode\u003eauditpol.exe\u003c/code\u003e with specific arguments related to disabling event logs.\u003c/li\u003e\n\u003cli\u003eMonitor process creation events for \u003ccode\u003elogman.exe\u003c/code\u003e, \u003ccode\u003epowershell.exe\u003c/code\u003e, \u003ccode\u003epwsh.exe\u003c/code\u003e, \u003ccode\u003epowershell_ise.exe\u003c/code\u003e, and \u003ccode\u003eauditpol.exe\u003c/code\u003e with command-line arguments that indicate an attempt to disable event logging.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon process creation logging to capture detailed command-line arguments for process monitoring.\u003c/li\u003e\n\u003cli\u003eRegularly review and audit Group Policy settings related to event logging to prevent unauthorized modifications.\u003c/li\u003e\n\u003cli\u003eMonitor for changes to the EventLog service configuration, including startup type and status, using system monitoring tools.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-04T10:00:00Z","date_published":"2024-01-04T10:00:00Z","id":"/briefs/2024-01-disable-windows-logs/","summary":"Attackers attempt to disable Windows Event and Security Logs using logman, PowerShell, or auditpol to evade detection and cover their tracks.","title":"Disable Windows Event and Security Logs Using Built-in Tools","url":"https://feed.craftedsignal.io/briefs/2024-01-disable-windows-logs/"}],"language":"en","title":"CraftedSignal Threat Feed — Eventlog","version":"https://jsonfeed.org/version/1.1"}