Disable or Modify Windows Event Log
Subtechnique · ATTACK:enterprise:T1685.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1685.001",
"title": "Disable or Modify Windows Event Log",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1685/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--1411e6b8-80a6-4465-9909-54eaa9c67ce0",
"external_id": "T1685.001",
"domain": "enterprise",
"created": "2026-04-14T22:54:01.982Z",
"modified": "2026-05-12T15:12:00.621Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"defense-impairment"
],
"source_references": [
{
"source_name": "Disable_Win_Event_Logging",
"url": "https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1562-impair-defenses/disable-windows-event-logging"
},
{
"source_name": "EventLog_Core_Technologies",
"url": "https://www.coretechnologies.com/blog/windows-services/eventlog/"
},
{
"source_name": "disable_win_evt_logging",
"url": "https://ptylu.github.io/content/report/report.html?report=25"
},
{
"source_name": "Microsoft Audit Policy",
"url": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-policy"
},
{
"source_name": "Microsoft Adv Security Settings",
"url": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"
},
{
"source_name": "Microsoft auditpol",
"url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol"
},
{
"source_name": "winser19_file_overwrite_bug_twitter",
"url": "https://web.archive.org/web/20211107115646/https://twitter.com/klinix5/status/1457316029114327040"
},
{
"source_name": "T1562.002_redcanaryco",
"url": "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.002/T1562.002.md"
},
{
"source_name": "auditpol.exe_STRONTIC",
"url": "https://strontic.github.io/xcyclopedia/library/auditpol.exe-214E0EA1F7F7C27C82D23F183F9D23F1.html"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1896ec8f-6d51-4939-a89c-a3788314366a
ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31ca8630-4b0a-4e5f-a3eb-45c8ee8841ad
ATTACK:enterprise:T1685.001 → subtechnique-of → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ec211cb-7fbc-4d41-ad56-f599dee5f190
ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4316c8f0-37e1-4a99-a34f-362ec94fe6b9
def_ev_win_event_loggingATTACK:enterprise:C0025 → uses → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59c982c5-c471-44fc-9ace-721866be4e18
Dragos Crashoverride 2018ATTACK:enterprise:S0645 → uses → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67539c7a-5b11-4080-aa6b-1b370e0d321d
Wevtutil Microsoft DocumentationATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69bb1028-e746-4b3a-9b96-9e9c66109c61
DFIR Phosphorus November 2021ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--740cb688-3a2d-46fb-88de-6fbd61045889
Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee8e9551-278a-4f96-8179-d9290b95ed99
win_xml_evt_logATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef6b8690-4a9f-4910-8178-e78df631ea7d
SecureWorks BRONZE UNION June 2017ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fab61ab8-acbb-41ce-ae5f-1356443b16bb
Microsoft Albanian Government Attacks September 2022