Elastic Security Detection Rules

Disable Windows Event and Security Logs Using Built-in Tools

Last updated 10 days ago on 2025-02-21
Created 4 years ago on 2021-05-06

About

Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system.
Tags
Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: Defense EvasionData Source: Elastic EndgameData Source: Elastic DefendData Source: Windows Security Event LogsData Source: Microsoft Defender for EndpointData Source: SysmonData Source: SentinelOneData Source: CrowdstrikeLanguage: eql
Severity
low
Risk Score
21
MITRE ATT&CK™

Defense Evasion (TA0005)(opens in a new tab or window)

↳ Indicator Removal (T1070)(opens in a new tab or window)

↳ Impair Defenses (T1562)(opens in a new tab or window)

License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Event Correlation Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
endgame-*logs-crowdstrike.fdr*logs-endpoint.events.process-*logs-m365_defender.event-*logs-sentinel_one_cloud_funnel.*logs-system.security*logs-windows.forwarded*logs-windows.sysmon_operational-*winlogbeat-*
Related Integrations

endpoint(opens in a new tab or window)

windows(opens in a new tab or window)

system(opens in a new tab or window)

m365_defender(opens in a new tab or window)

sentinel_one_cloud_funnel(opens in a new tab or window)

crowdstrike(opens in a new tab or window)

Query
process where host.os.type == "windows" and event.type == "start" and
(
  (
    (process.name:"logman.exe" or ?process.pe.original_file_name == "Logman.exe") and
    process.args : "EventLog-*" and process.args : ("stop", "delete")
  ) or
  (
    (
      process.name : ("pwsh.exe", "powershell.exe", "powershell_ise.exe") or
      ?process.pe.original_file_name in ("pwsh.exe", "powershell.exe", "powershell_ise.exe")
    ) and
	  process.args : "Set-Service" and process.args: "EventLog" and process.args : "Disabled"
  )  or
  (
    (process.name:"auditpol.exe" or ?process.pe.original_file_name == "AUDITPOL.EXE") and process.args : "/success:disable"
  )
)

Install detection rules in Elastic Security

Detect Disable Windows Event and Security Logs Using Built-in Tools in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).