Esc

Disable Windows Event Logging - T1562.002

(ATT&CK® Technique)

Definition

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more. This data is used by security tools and analysts to generate detections.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1562002["Disable Windows Event Logging"] --> |may-modify| ApplicationConfiguration["Application Configuration"]; class T1562002 OffensiveTechniqueNode;
        class ApplicationConfiguration ArtifactNode; click ApplicationConfiguration href "/dao/artifact/d3f:ApplicationConfiguration";
        click T1562002 href "/offensive-technique/attack/T1562.002/"; click ApplicationConfiguration href "/dao/artifact/d3f:ApplicationConfiguration"; T1562002["Disable Windows Event Logging"] --> |may-modify| OperatingSystemConfigurationComponent["Operating System Configuration Component"]; class T1562002 OffensiveTechniqueNode;
        class OperatingSystemConfigurationComponent ArtifactNode; click OperatingSystemConfigurationComponent href "/dao/artifact/d3f:OperatingSystemConfigurationComponent";
        click T1562002 href "/offensive-technique/attack/T1562.002/"; click OperatingSystemConfigurationComponent href "/dao/artifact/d3f:OperatingSystemConfigurationComponent";                          ApplicationConfigurationHardening["Application Configuration Hardening"] -->
          | hardens | ApplicationConfiguration["Application Configuration"];

          ApplicationConfigurationHardening["Application Configuration Hardening"] -.->
            | may-harden | T1562002["Disable Windows Event Logging"] ;
          class ApplicationConfigurationHardening DefensiveTechniqueNode;
          class ApplicationConfiguration ArtifactNode;
          click ApplicationConfigurationHardening href "/technique/d3f:ApplicationConfigurationHardening";   RestoreConfiguration["Restore Configuration"] -->
          | restores | ApplicationConfiguration["Application Configuration"];

          RestoreConfiguration["Restore Configuration"] -.->
            | may-restore | T1562002["Disable Windows Event Logging"] ;
          class RestoreConfiguration DefensiveTechniqueNode;
          class ApplicationConfiguration ArtifactNode;
          click RestoreConfiguration href "/technique/d3f:RestoreConfiguration"; RestoreConfiguration["Restore Configuration"] -->
          | restores | OperatingSystemConfigurationComponent["Operating System Configuration Component"];

          
          class RestoreConfiguration DefensiveTechniqueNode;
          class OperatingSystemConfigurationComponent ArtifactNode;
          click RestoreConfiguration href "/technique/d3f:RestoreConfiguration";

json