T1685.001 — Disable or Modify Windows Event Log

Tactic: Defense Impairment · Platforms: Windows

Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user and system activity such as login attempts and process creation. This data is used by security tools and analysts to generate detections. The…

Sub-technique of Disable or Modify Tools (T1685).

Sigma detection rules (1)

T1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log

title: "T1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log"
id: d1bae9ac-8a99-4cbf-9e68-836ec59b55bf
description: 'Detects modification of EventLog service or Autologger registry configuration indicative of disabling event-log collection. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: AuthorizedAdminAccounts, TimeWindow, ServiceNames.'
references:
  - https://attack.mitre.org/techniques/T1685/001
author: Shahrukh Khan
date: 2026-01-11
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.001

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection_eventlog_service:
    EventID:
      - '13'
      - '14'
    TargetObject|contains: '\SYSTEM\CurrentControlSet\Services\EventLog\'
    TargetObject|endswith:
      - '\Enabled'
      - '\Retention'
      - '\MaxSize'
      - '\Start'
  selection_autologger:
    EventID:
      - '13'
      - '14'
    TargetObject|contains: '\CurrentControlSet\Control\WMI\Autologger\'
    TargetObject|endswith:
      - '\Enabled'
      - '\Start'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_eventlog_service or selection_autologger) and not filter_system_account

falsepositives:
  - None expected commonly for these keys.

level: medium

Related sub-techniques

Explore