Disable or Modify Windows Event Log

ATT&CK T1685.001

Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user and system activity such as login attempts and process creation.(Citation: EventLog_Core_Technologies) This data is used by security tools and analysts to generate detections. The EventLog service maintains event logs from various system components and applications. By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog s

Category: Technique, defense-impairment

MITRE ATT&CK: T1685.001

Reference: MITRE ATT&CK T1685.001