Disable Windows Event Logging
Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections. The EventLog service maintains event logs from various system components and applications.(Citation: EventLog_Core_Technologies) By default, the service automatically starts when ...
BY SOURCE
PROCEDURES (26)
Auto-extracted: 6 detections for lateral
Auto-extracted: 4 detections for process creation monitoring
Auto-extracted: 3 detections for tamper
Auto-extracted: 3 detections for http
Auto-extracted: 2 detections for registry
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for driver
Auto-extracted: 1 detections for process access monitoring
Auto-extracted: 1 detections for authentication monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for tamper