Detect Disable Windows Event Logging in Google Chronicle
Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. This includes stopping the EventLog service, modifying audit policies with auditpol.exe, altering registry keys that control event log autologger sessions, or using wevtutil to disable specific logs. Adversaries may also target application-specific logging such as IIS logs using appcmd.exe.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Sub-technique
- T1562.002 Disable Windows Event Logging
- Canonical reference
- https://attack.mitre.org/techniques/T1562/002/
YARA-L Detection Query
rule t1562_002_disable_windows_event_logging {
meta:
author = "Argus Detection Engineering"
description = "Detects attempts to disable or tamper with Windows event logging via sc.exe, net.exe, wevtutil.exe, auditpol.exe, or PowerShell Stop-Service/Set-Service commands"
mitre_attack_tactic = "Defense Evasion"
mitre_attack_technique = "T1562.002"
mitre_attack_url = "https://attack.mitre.org/techniques/T1562/002/"
severity = "HIGH"
confidence = "HIGH"
rule_version = "1.0"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
$e.principal.hostname = $hostname
re.regex(
$e.target.process.command_line,
`(?i)(sc\s+(stop|config)\s+eventlog|net\s+stop\s+eventlog|(stop-service|set-service).{0,40}eventlog|wevtutil\s+(cl|sl)\b|auditpol\s+/(clear|set|remove))`
)
condition:
$e
}
rule t1562_002_audit_log_cleared {
meta:
author = "Argus Detection Engineering"
description = "Detects Windows Security audit log cleared (EID 1102) or audit policy changed (EID 4719) — indicators of T1562.002 post-tampering evidence destruction"
mitre_attack_tactic = "Defense Evasion"
mitre_attack_technique = "T1562.002"
severity = "CRITICAL"
confidence = "HIGH"
events:
$e.metadata.event_type = "USER_RESOURCE_ACCESS"
$e.principal.hostname = $hostname
$e.metadata.product_event_type in ("1102", "4719")
condition:
$e
}Two Chronicle YARA-L 2.0 rules for T1562.002: the first matches process launch events where the command line contains EventLog service tampering patterns (sc.exe, net.exe, wevtutil, auditpol, PowerShell); the second detects the resulting artifacts — Windows Security log cleared (EID 1102) or audit policy changed (EID 4719).
Data Sources
Required Tables
False Positives & Tuning
- System administrators running auditpol.exe during quarterly audit policy reviews or after Active Directory Group Policy changes
- Automated penetration testing tooling in authorized red team engagements that clears logs as part of post-exploitation cleanup simulation
- Windows Server backup agents using wevtutil sl to reconfigure log size limits or retention policies during maintenance
Other platforms for T1562.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Clear Security Event Log with wevtutil
Expected signal: Security Event ID 1102 (audit log cleared) as the final event. Sysmon Event ID 1 with Image=wevtutil.exe and CommandLine='wevtutil cl Security'.
- Test 2Clear All Audit Policies with auditpol
Expected signal: Security Event ID 4719 (system audit policy changed). Sysmon Event ID 1 with Image=auditpol.exe.
- Test 3Disable EventLog Service via Registry
Expected signal: Sysmon Event ID 13: Registry value set for HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Start with value 4 (disabled). Sysmon Event ID 1: reg.exe process creation.
References (5)
- https://attack.mitre.org/techniques/T1562/002/
- https://ptylu.github.io/content/report/report.html?report=25
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.002/T1562.002.md
- https://learn.microsoft.com/en-us/windows/win32/eventlog/event-log-security
Unlock Pro Content
Get the full detection package for T1562.002 including response playbook, investigation guide, and atomic red team tests.