Detect Disable Windows Event Logging in Sumo Logic CSE
Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. This includes stopping the EventLog service, modifying audit policies with auditpol.exe, altering registry keys that control event log autologger sessions, or using wevtutil to disable specific logs. Adversaries may also target application-specific logging such as IIS logs using appcmd.exe.
MITRE ATT&CK
- Tactic
- Defense Impairment
- Technique
- T1685 Disable or Modify Tools
- Sub-technique
- T1685.001 Disable or Modify Windows Event Log
- Canonical reference
- https://attack.mitre.org/techniques/T1685/001/
Sumo Detection Query
(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*WinEventLog*)
| where (EventID in ("1", "4688") and (
CommandLine matches /(?i)sc\s+(stop|config)\s+eventlog/ or
CommandLine matches /(?i)net\s+stop\s+eventlog/ or
CommandLine matches /(?i)(stop-service|set-service).{0,40}eventlog/ or
CommandLine matches /(?i)wevtutil\s+(cl|sl)/ or
CommandLine matches /(?i)auditpol\s+\/(clear|set|remove)/
)) or EventID = "1102" or EventID = "4719"
| eval TamperType = if(EventID = "1102", "Security Log Cleared (EID 1102)",
if(EventID = "4719", "Audit Policy Changed (EID 4719)",
if(CommandLine matches /(?i)sc\s+(stop|config).*eventlog/, "EventLog Service Tampering",
if(CommandLine matches /(?i)(net\s+stop|stop-service).*eventlog/, "EventLog Service Stop",
if(CommandLine matches /(?i)wevtutil\s+cl/, "Event Log Clear via wevtutil",
if(CommandLine matches /(?i)wevtutil\s+sl/, "Event Log Settings Modified via wevtutil",
if(CommandLine matches /(?i)auditpol\s+\/clear/, "Audit Policy Cleared",
if(CommandLine matches /(?i)auditpol\s+\/set/, "Audit Policy Modified",
if(CommandLine matches /(?i)auditpol\s+\/remove/, "Audit Policy Users Removed",
"Unknown")))))))))
| table _time, Computer, User, EventID, TamperType, CommandLine
| sort by _time descSumo Logic CSE query detecting Windows event logging tampering via Sysmon EID 1 or Security EID 4688 process creation events matching sc.exe, net.exe, wevtutil, auditpol, and PowerShell patterns, plus direct detection of audit log cleared (EID 1102) and audit policy changed (EID 4719).
Data Sources
Required Tables
False Positives & Tuning
- IT operations running wevtutil cl on test systems or during log rotation procedures without proper change documentation
- Compliance tooling that reconfigures audit policies (auditpol /set) on a scheduled basis as part of CIS benchmark enforcement
- Endpoint management agents stopping and restarting the EventLog service during software deployment or patching cycles
Other platforms for T1685.001
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Clear Security Event Log with wevtutil
Expected signal: Security Event ID 1102 (audit log cleared) as the final event. Sysmon Event ID 1 with Image=wevtutil.exe and CommandLine='wevtutil cl Security'.
- Test 2 Clear All Audit Policies with auditpol
Expected signal: Security Event ID 4719 (system audit policy changed). Sysmon Event ID 1 with Image=auditpol.exe.
- Test 3 Disable EventLog Service via Registry
Expected signal: Sysmon Event ID 13: Registry value set for HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Start with value 4 (disabled). Sysmon Event ID 1: reg.exe process creation.
Response Playbook
Triage
- Determine which event log or audit category was targeted — Security, System, Application, or a specific provider log?
- Check if Event ID 1102 was generated — this confirms the Security log was actually cleared. Note the SubjectUserName and SubjectDomainName.
- For auditpol changes (Event ID 4719) — compare the new audit policy with the organization's baseline to determine exactly what was weakened
- Identify the user context — was this a domain admin, local admin, or service account? Validate against change management records.
- Check for temporal correlation — was the logging impairment preceded by suspicious authentication, followed by lateral movement or data exfiltration?
Containment
- Immediately restore audit policy from GPO baseline: gpupdate /force on affected host
- If EventLog service was stopped/disabled: restart it (sc start EventLog, sc config EventLog start=auto)
- Preserve any remaining logs and forward to SIEM before they are rotated or overwritten
- If clearing occurred on a domain controller: initiate domain-wide audit policy verification across all DCs
- Isolate the endpoint if other compromise indicators are present
Evidence Collection
- Security Event ID 1102 — the log-clearing event itself, includes the clearing account identity
- Security Event ID 4719 — system audit policy was changed, includes old and new policy values
- Sysmon Event ID 1 — process creation for auditpol.exe, wevtutil.exe, or sc.exe
- System Event ID 7036/7040 — EventLog service state and start type changes
- Registry: HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-* — Start and Enabled values
- SIEM: preserved copies of forwarded events that may have been cleared from the local log
Escalation Criteria
- !Security event log cleared with no corresponding change ticket
- !Audit policy silently changed to disable logon, process creation, or privilege use auditing
- !Event logging disabled on domain controllers or other critical infrastructure
- !Log clearing followed by account creation, lateral movement, or data exfiltration
- !Multiple hosts showing simultaneous log clearing (coordinated attack)
Investigation Guide
Forensic Artifacts
- >
Event Log: Security Event ID 1102 — contains SubjectUserName that cleared the log - >
Event Log: Security Event ID 4719 — contains old and new audit policy settings - >
Registry: HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security — Start value (0=disabled) - >
Registry: HKLM\SYSTEM\CurrentControlSet\Services\EventLog — Start value for EventLog service - >
File System: C:\Windows\System32\winevt\Logs\*.evtx — file timestamps show when logs were last written/cleared - >
Prefetch: C:\Windows\Prefetch\WEVTUTIL.EXE-*.pf, AUDITPOL.EXE-*.pf — execution timestamps
Tuning Guidance
Event ID 1102 (log cleared) should almost never be suppressed — it is a critical detection. Exceptions should only be made for documented log rotation processes with specific service accounts. For auditpol monitoring, baseline your expected audit policy and alert on any deviation. Consider deploying a canary audit policy setting that should never change. If your environment uses scheduled log clearing, ensure those scripts run under a dedicated service account so you can exclude them precisely.
Hunting Queries
Hunt for accounts that have cleared the Security event log. In most environments, this should be extremely rare. Any account clearing logs on multiple hosts is highly suspicious.
SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID == 1102
| summarize ClearCount=count(), Hosts=make_set(Computer) by SubjectUserName, SubjectDomainName
| sort by ClearCount descindex=wineventlog sourcetype="WinEventLog:Security" EventCode=1102
| stats count as ClearCount, values(host) as Hosts by SubjectUserName, SubjectDomainName
| sort - ClearCountHunt for all auditpol.exe executions. In most environments, auditpol should only be called by GPO processing or during initial setup. Interactive use is suspicious.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "auditpol.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\auditpol.exe"
| table _time, host, User, CommandLine, ParentImage
| sort - _timeAtomic Red Team Tests
Clears the Windows Security event log. This generates Event ID 1102 as the final entry before the log is wiped. Used by numerous threat actors (APT41, Threat Group-3390, Magic Hound) to cover tracks after exploitation.
Command
wevtutil cl SecurityExpected Telemetry
Security Event ID 1102 (audit log cleared) as the final event. Sysmon Event ID 1 with Image=wevtutil.exe and CommandLine='wevtutil cl Security'.
Expected Detection
KQL: TamperType='Event Log Clear'. SPL: TamperType='Event Log Clear (wevtutil)' and EventCode=1102.
Uses auditpol /clear /y to remove all audit policies, effectively disabling Security event generation. The /y flag suppresses confirmation. This generates Security Event ID 4719.
Command
auditpol /clear /yCleanup
auditpol /set /category:* /success:enable /failure:enableExpected Telemetry
Security Event ID 4719 (system audit policy changed). Sysmon Event ID 1 with Image=auditpol.exe.
Expected Detection
KQL: TamperType='Audit Policy Clear'. SPL: TamperType='Audit Policy Cleared' and EventCode=4719.
Modifies the EventLog service Start registry value to disable the service. This persists across reboots but does not take effect until the next restart, making it a stealthy technique.
Command
reg add HKLM\SYSTEM\CurrentControlSet\Services\EventLog /v Start /t REG_DWORD /d 4 /fCleanup
reg add HKLM\SYSTEM\CurrentControlSet\Services\EventLog /v Start /t REG_DWORD /d 2 /fExpected Telemetry
Sysmon Event ID 13: Registry value set for HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Start with value 4 (disabled). Sysmon Event ID 1: reg.exe process creation.
Expected Detection
KQL: TamperType='Autologger Registry Modified'. SPL: Registry event targeting EventLog service Start value.