Techniques › T1685.001 › AN0535
AN0535 Analytic 0535
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of attempts to disable or tamper with Windows Event Logging. This includes stopping or disabling the EventLog service, modifying registry keys related to EventLog and Autologger, using
auditpol or wevtutil to disable categories or clear audit policies, and detecting suspicious gaps or resets in event logs. Defenders observe registry changes, service state changes, process execution of disabling commands, and anomalies in event record sequences.</p>- Detects
- T1685.001 Disable or Modify Windows Event Log
- Part of
- DET0187 Detect Disabled Windows Event Log
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:System | EventCode=7035 | DC0041 Service Metadata |
| WinEventLog:Security | EventCode=1102 | DC0038 Application Log Content |
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AuthorizedAdminAccounts | List of accounts authorized to legitimately modify audit policies or disable services. |
TimeWindow | Correlation window between registry modification, service stop, and audit policy commands. |
ServiceNames | Customizable set of monitored services such as EventLog, Sysmon, or custom loggers. |