{"id":"T1685.001","name":"Disable or Modify Windows Event Log","url":"https://attack.mitre.org/techniques/T1685/001","tactics":["defense-impairment"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0187","stix_id":"x-mitre-detection-strategy--cfedfc6c-6e31-481b-be1e-e23a760fec44","name":"Detect Disabled Windows Event Log","url":"https://attack.mitre.org/detectionstrategies/DET0187","analytics":[{"id":"AN0535","stix_id":"x-mitre-analytic--705168ad-1701-453c-9aea-c75029492b89","name":"Analytic 0535","description":"Detection of attempts to disable or tamper with Windows Event Logging. This includes stopping or disabling the EventLog service, modifying registry keys related to EventLog and Autologger, using `auditpol` or `wevtutil` to disable categories or clear audit policies, and detecting suspicious gaps or resets in event logs. Defenders observe registry changes, service state changes, process execution of disabling commands, and anomalies in event record sequences.","url":"https://attack.mitre.org/detectionstrategies/DET0187#AN0535","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:System","channel":"EventCode=7035","data_component":"DC0041","data_component_name":"Service Metadata","log_source_slug":"wineventlog-system"},{"name":"WinEventLog:Security","channel":"EventCode=1102","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"AuthorizedAdminAccounts","description":"List of accounts authorized to legitimately modify audit policies or disable services."},{"field":"TimeWindow","description":"Correlation window between registry modification, service stop, and audit policy commands."},{"field":"ServiceNames","description":"Customizable set of monitored services such as EventLog, Sysmon, or custom loggers."}],"live":true,"detection_strategies":["DET0187"],"techniques":["T1685.001"]}],"live":true,"version":"1.0","techniques":["T1685.001"]}],"sigma_rules":[{"id":"0a13e132-651d-11eb-ae93-0242ac130002","title":"Audit Policy Tampering Via Auditpol","author":"Janantha Marasinghe (https://github.com/blueteam0ps)","status":"test","level":"high","date":"2021-02-02","modified":"2023-02-22","description":"Threat actors can use auditpol binary to change audit policy configuration to impair detection capability.\nThis can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.\n","references":["https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/process_creation/proc_creation_win_auditpol_susp_execution.yml","techniques":["T1685.001"],"cves":[]},{"id":"0cb8d736-995d-4ce7-a31e-1e8d452a1459","title":"Potential EventLog File Location Tampering","author":"D3F7A5105","status":"test","level":"high","date":"2023-01-02","modified":"2023-08-17","description":"Detects tampering with EventLog service \"file\" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting","references":["https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/registry/registry_set/registry_set_evtx_file_key_tamper.yml","techniques":["T1685.001"],"cves":[]},{"id":"166e9c50-8cd9-44af-815d-d1f0c0e90dde","title":"Suspicious Svchost Process Access","author":"Tim Burrell","status":"test","level":"high","date":"2020-01-02","modified":"2023-01-30","description":"Detects suspicious access to the \"svchost\" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service.","references":["https://github.com/hlldz/Invoke-Phant0m","https://twitter.com/timbmsft/status/900724491076214784"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/process_access/proc_access_win_svchost_susp_access_request.yml","techniques":["T1685.001"],"cves":[]},{"id":"1a4bd6af-99ac-4466-b5b2-7b72b4a05462","title":"Security Event Logging Disabled via MiniNt Registry Key - Process","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-04-09","modified":null,"description":"Detects attempts to disable security event logging by adding the `MiniNt` registry key.\nThis key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.\nAdversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.\n","references":["https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1112","car.2022-03-001"],"path":"rules/windows/process_creation/proc_creation_win_event_logging_disable_via_key_minint.yml","techniques":["T1685.001","T1112"],"cves":[]},{"id":"2f78da12-f7c7-430b-8b19-a28f269b77a3","title":"Disable Windows Event Logging Via Registry","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-04","modified":"2024-03-25","description":"Detects tampering with the \"Enabled\" registry key in order to disable Windows logging of a Windows event channel","references":["https://twitter.com/WhichbufferArda/status/1543900539280293889","https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml","techniques":["T1685.001"],"cves":[]},{"id":"4931188c-178e-4ee7-a348-39e8a7a56821","title":"Filter Driver Unloaded Via Fltmc.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-13","modified":"2025-10-07","description":"Detect filter driver unloading activity via fltmc.exe","references":["https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon","https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.defense-impairment","attack.t1070","attack.t1685","attack.t1685.001"],"path":"rules/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml","techniques":["T1070","T1685","T1685.001"],"cves":[]},{"id":"49329257-089d-46e6-af37-4afce4290685","title":"HackTool - SharpEvtMute DLL Load","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-09-07","modified":"2024-11-23","description":"Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs","references":["https://github.com/bats3c/EvtMute"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/image_load/image_load_hktl_sharpevtmute.yml","techniques":["T1685.001"],"cves":[]},{"id":"4d7cda18-1b12-4e52-b45c-d28653210df8","title":"Sysmon Driver Unloaded Via Fltmc.EXE","author":"Kirill Kiryanov, oscd.community","status":"test","level":"high","date":"2019-10-23","modified":"2023-02-13","description":"Detects possible Sysmon filter driver unloaded via fltmc.exe","references":["https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.defense-impairment","attack.t1070","attack.t1685","attack.t1685.001"],"path":"rules/windows/process_creation/proc_creation_win_fltmc_unload_driver_sysmon.yml","techniques":["T1070","T1685","T1685.001"],"cves":[]},{"id":"65236ec7-ace0-4f0c-82fd-737b04fd4dcb","title":"EVTX Created In Uncommon Location","author":"D3F7A5105","status":"test","level":"medium","date":"2023-01-02","modified":"2024-03-26","description":"Detects the creation of new files with the \".evtx\" extension in non-common or non-standard location.\nThis could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within.\nNote that backup software and legitimate administrator might perform similar actions during troubleshooting.\n","references":["https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations.yml","techniques":["T1685.001"],"cves":[]},{"id":"69aeb277-f15f-4d2d-b32a-55e883609563","title":"Windows Event Auditing Disabled","author":"@neu5ron, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2017-11-19","modified":"2023-11-15","description":"Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled.\nThis may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed.\nAlso, it is recommended to turn off \"Local Group Policy Object Processing\" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as \"gpedit.msc\".\nPlease note, that disabling \"Local Group Policy Object Processing\" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways.\n","references":["https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit"],"logsource":{"product":"windows","service":"security"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/builtin/security/win_security_disable_event_auditing.yml","techniques":["T1685.001"],"cves":[]},{"id":"7d9263bd-dc47-4a58-bc92-5474abab390c","title":"Change Winevt Channel Access Permission Via Registry","author":"frack113","status":"test","level":"high","date":"2022-09-17","modified":"2024-03-25","description":"Detects tampering with the \"ChannelAccess\" registry key in order to change access to Windows event channel.","references":["https://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/","https://learn.microsoft.com/en-us/windows/win32/api/winevt/","https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/registry/registry_set/registry_set_change_winevt_channelaccess.yml","techniques":["T1685.001"],"cves":[]},{"id":"8839e550-52d7-4958-9f2f-e13c1e736838","title":"Security Event Logging Disabled via MiniNt Registry Key - Registry Set","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-04-09","modified":null,"description":"Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events.\nWindows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing.\nAdversary may want to disable this service to disable logging of security events which could be used to detect their activities.\n","references":["https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1112","car.2022-03-001"],"path":"rules/windows/registry/registry_set/registry_set_create_minint_key.yml","techniques":["T1685.001","T1112"],"cves":[]},{"id":"919f2ef0-be2d-4a7a-b635-eb2b41fde044","title":"Disable Security Events Logging Adding Reg Key MiniNt","author":"Ilyas Ochkov, oscd.community","status":"test","level":"high","date":"2019-10-25","modified":"2021-11-27","description":"Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.","references":["https://twitter.com/0gtweet/status/1182516740955226112","https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1112","car.2022-03-001"],"path":"rules/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml","techniques":["T1685.001","T1112"],"cves":[]},{"id":"9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f","title":"Previously Installed IIS Module Was Removed","author":"Nasreddine Bencherchali","status":"test","level":"low","date":"2024-10-06","modified":null,"description":"Detects the removal of a previously installed IIS module.","references":["https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis","https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/","https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview"],"logsource":{"product":"windows","service":"iis-configuration"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1505.004"],"path":"rules/windows/builtin/iis-configuration/win_iis_module_removed.yml","techniques":["T1685.001","T1505.004"],"cves":[]},{"id":"a5b40a90-baf5-4bf7-a6f7-373494881d22","title":"ETW Logging/Processing Option Disabled On IIS Server","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2024-10-06","modified":null,"description":"Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.","references":["https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis","https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/"],"logsource":{"product":"windows","service":"iis-configuration"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1505.004"],"path":"rules/windows/builtin/iis-configuration/win_iis_logging_etw_disabled.yml","techniques":["T1685.001","T1505.004"],"cves":[]},{"id":"ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1","title":"Important Windows Event Auditing Disabled","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-20","modified":"2023-11-17","description":"Detects scenarios where system auditing for important events such as \"Process Creation\" or \"Logon\" events is disabled.","references":["https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit","https://github.com/SigmaHQ/sigma/blob/ad1bfd3d28aa0ccc9656240f845022518ef65a2e/documentation/logsource-guides/windows/service/security.md"],"logsource":{"product":"windows","service":"security"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/builtin/security/win_security_disable_event_auditing_critical.yml","techniques":["T1685.001"],"cves":[]},{"id":"b92d1d19-f5c9-4ed6-bbd5-7476709dc389","title":"Forest Blizzard APT - File Creation Activity","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-04-23","modified":"2024-07-11","description":"Detects the creation of specific files inside of ProgramData directory.\nThese files were seen being created by Forest Blizzard as described by MSFT.\n","references":["https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.defense-impairment","attack.t1685.001","detection.emerging-threats"],"path":"rules-emerging-threats/2024/TA/Forest-Blizzard/file_event_win_apt_forest_blizzard_activity.yml","techniques":["T1685.001"],"cves":[]},{"id":"bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c","title":"HackTool - SharpEvtMute Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-09-07","modified":"2023-02-14","description":"Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs","references":["https://github.com/bats3c/EvtMute"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharpevtmute.yml","techniques":["T1685.001"],"cves":[]},{"id":"c2c76b77-32be-4d1f-82c9-7e544bdfe0eb","title":"Potential Suspicious Activity Using SeCEdit","author":"Janantha Marasinghe","status":"test","level":"medium","date":"2022-11-18","modified":"2022-12-30","description":"Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy","references":["https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.discovery","attack.persistence","attack.credential-access","attack.privilege-escalation","attack.execution","attack.stealth","attack.defense-impairment","attack.t1685.001","attack.t1547.001","attack.t1505.005","attack.t1556.002","attack.t1685","attack.t1574.007","attack.t1564.002","attack.t1546.008","attack.t1546.007","attack.t1547.014","attack.t1547.010","attack.t1547.002","attack.t1557","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_secedit_execution.yml","techniques":["T1685.001","T1547.001","T1505.005","T1556.002","T1685","T1574.007","T1564.002","T1546.008","T1546.007","T1547.014","T1547.010","T1547.002","T1557","T1082"],"cves":[]},{"id":"c6c56ada-612b-42d1-9a29-adad3c5c2c1e","title":"Audit Policy Tampering Via NT Resource Kit Auditpol","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-12-18","modified":"2023-02-21","description":"Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability.\nThis can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.\n","references":["https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Windows%202000%20Resource%20Kit%20Tools/AuditPol"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/process_creation/proc_creation_win_auditpol_nt_resource_kit_usage.yml","techniques":["T1685.001"],"cves":[]},{"id":"cc36992a-4671-4f21-a91d-6c2b72a2edf5","title":"Suspicious Eventlog Clearing or Configuration Change Activity","author":"Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"stable","level":"high","date":"2019-09-26","modified":"2026-06-01","description":"Detects the clearing or configuration tampering of EventLog using utilities such as \"wevtutil\", \"powershell\" and \"wmic\".\nThis technique were seen used by threat actors and ransomware strains in order to evade defenses.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md","https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil","https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee","https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/","https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc","https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7","https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_","https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1685.005","attack.t1685.001","car.2016-04-002"],"path":"rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml","techniques":["T1685.005","T1685.001"],"cves":[]},{"id":"d29ada0f-af45-4f27-8f32-f7b77c3dbc4e","title":"HackTool - SysmonEnte Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-09-07","modified":"2026-06-29","description":"Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon","references":["https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html","https://github.com/codewhitesec/SysmonEnte/","https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/process_access/proc_access_win_hktl_sysmonente.yml","techniques":["T1685.001"],"cves":[]},{"id":"d7b81144-b866-48a4-9bcc-275dc69d870e","title":"Windows EventLog Autologger Session Registry Modification Via CommandLine","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-12-25","modified":null,"description":"Detects attempts to disable Windows EventLog autologger sessions via registry modification.\nThe AutoLogger event tracing session records events that occur early in the operating system boot process.\nApplications and device drivers can use the AutoLogger session to capture traces before the user logs in.\nAdversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.\n","references":["https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session","https://ptylu.github.io/content/report/report.html?report=25","https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification.yml","techniques":["T1685.001"],"cves":[]},{"id":"dd857d3e-0c6e-457b-9b48-e82ae7f86bd7","title":"New Module Module Added To IIS Server","author":"frack113","status":"test","level":"medium","date":"2024-10-06","modified":null,"description":"Detects the addition of a new module to an IIS server.","references":["https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis","https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/","https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview"],"logsource":{"product":"windows","service":"iis-configuration"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1505.004"],"path":"rules/windows/builtin/iis-configuration/win_iis_module_added.yml","techniques":["T1685.001","T1505.004"],"cves":[]},{"id":"e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e","title":"Disable Windows IIS HTTP Logging","author":"frack113","status":"test","level":"high","date":"2022-01-09","modified":"2023-01-22","description":"Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.002/T1562.002.md#atomic-test-1---disable-windows-iis-http-logging"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/process_creation/proc_creation_win_iis_appcmd_http_logging.yml","techniques":["T1685.001"],"cves":[]},{"id":"e8ebd53a-30c2-45bd-81bb-74befba07bdb","title":"HTTP Logging Disabled On IIS Server","author":"frack113","status":"test","level":"high","date":"2024-10-06","modified":null,"description":"Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.","references":["https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis","https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging"],"logsource":{"product":"windows","service":"iis-configuration"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1505.004"],"path":"rules/windows/builtin/iis-configuration/win_iis_logging_http_disabled.yml","techniques":["T1685.001","T1505.004"],"cves":[]},{"id":"ec7c4e9b-9bc9-47c7-a32f-b53b598da642","title":"Forest Blizzard APT - JavaScript Constrained File Creation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2024-04-23","modified":null,"description":"Detects the creation of JavaScript files inside of the DriverStore directory.\nForest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.\n","references":["https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.defense-impairment","attack.t1685.001","detection.emerging-threats"],"path":"rules-emerging-threats/2024/TA/Forest-Blizzard/file_event_win_apt_forest_blizzard_constrained_js.yml","techniques":["T1685.001"],"cves":[]},{"id":"f37b4bce-49d0-4087-9f5b-58bffda77316","title":"Potential AutoLogger Sessions Tampering","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-01","modified":"2025-12-26","description":"Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging.\nThe AutoLogger event tracing session records events up that occur early in the operating system boot process.\nApplications and device drivers can use the AutoLogger session to capture traces before the user logs in, and also used by security solutions as telemetry source.\nAdversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.\n","references":["https://twitter.com/MichalKoczwara/status/1553634816016498688","https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/","https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf","https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session","https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.defense-impairment","attack.t1685.001"],"path":"rules/windows/registry/registry_set/registry_set_disable_autologger_sessions.yml","techniques":["T1685.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}