Benchmark: T1562.002 Impair Defenses: Disable Windows Event Logging

Overview

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.[1] This data is used by security tools and analysts to generate detections.

The EventLog service maintains event logs from various system components and applications.[2] By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.[3][4] auditpol.exe may also be used to set audit policies.[5]

Usage

Install the mod:

mkdir dashboards
cd dashboards
powerpipe mod init
powerpipe mod install github.com/turbot/tailpipe-mod-azure-activity-log-detections

Start the Powerpipe server:

powerpipe server

Open http://localhost:9033 in your browser and select T1562.002 Impair Defenses: Disable Windows Event Logging.

Run this benchmark in your terminal:

powerpipe benchmark run azure_activity_log_detections.benchmark.mitre_attack_v161_ta0005_t1562_002

Snapshot and share results via Turbot Pipes:

powerpipe benchmark run azure_activity_log_detections.benchmark.mitre_attack_v161_ta0005_t1562_002 --share

Detections

• Monitor Diagnostic Setting Deleted