CmdID

CmdID / Techniques / T1685

T1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log

Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. MITRE ATT&CK

2 programs on CmdID 10 Sigma rules T1685.001 on attack.mitre.org

Part of

MITRE ATT&CK
T1685Disable or Modify Tools

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
fltmc.exeits Sigma rulesreg.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highAudit Policy Tampering Via AuditpolJanantha Marasinghe (https://github.com/blueteam0ps) · Windows
highAudit Policy Tampering Via NT Resource Kit AuditpolNasreddine Bencherchali (Nextron Systems) · Windows
highDisable Windows IIS HTTP Loggingfrack113 · Windows
highHackTool - SharpEvtMute ExecutionFlorian Roth (Nextron Systems) · Windows
highSecurity Event Logging Disabled via MiniNt Registry Key - ProcessSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious Eventlog Clearing or Configuration Change ActivityEcco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSysmon Driver Unloaded Via Fltmc.EXEKirill Kiryanov, oscd.community · Windows
highWindows EventLog Autologger Session Registry Modification Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumFilter Driver Unloaded Via Fltmc.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumPotential Suspicious Activity Using SeCEditJanantha Marasinghe · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To delete the per-user audit policy for all users, reset (disable) the system audit policy for all subcategories, and set all the audit policy settings to disabled, at a confirmation prompt, type on the page for auditpol clear

auditpol /clearIdentify

To delete the per-user audit policy for all users, reset the system audit policy settings for all subcategories, and set all the audit policy settings to disabled, without a confirmation prompt, type on the page for auditpol clear

auditpol /clear /yIdentify

To remove the per-user audit policy for user mikedan by name, type on the page for auditpol remove

auditpol /remove /user:mikedanIdentify

To remove the per-user audit policy for user mikedan by SID, type on the page for auditpol remove

auditpol /remove /user:{S-1-5-21-397123471-12346959}Identify

To remove the per-user audit policy for all users, type on the page for auditpol remove

auditpol /remove /allusersIdentify

To remove all global resource SACL entries for files or folders on the page for auditpol resourcesacl

auditpol /resourceSACL /type:File /clearIdentify

To remove all global resource SACL entries for a particular user from files or folders on the page for auditpol resourcesacl

auditpol /resourceSACL /remove /type:File /user:{S-1-5-21-56248481-1302087933-1644394174-1001}Identify

To restore system audit policy settings, per-user audit policy settings for all users, and all auditing options from a file named auditpolicy.csv that was created by using the /backup command, type on the page for auditpol restore

auditpol /restore /file:c:\auditpolicy.csvIdentify

To set the system audit policy for the Object Access and System categories (which is implied because subcategories are listed) and subcategories specified by GUIDs for the suppression of failed attempts and the auditing of successful attempts, type on the page for auditpol set

auditpol /set /subcategory:{0ccee9210-69ae-11d9-bed3-505054503030},{0ccee9211-69ae-11d9-bed3-505054503030}, /failure:disable /success:enableIdentify

To incorporate changes required by the analysis process on the SecContoso.inf file, and then to direct the output to the existing file, SecAnalysisContosoFY11, without prompting, type on the page for secedit configure

secedit /configure /db C:\Security\FY11\SecDbContoso.sdb /cfg SecContoso.inf /overwrite /log C:\Security\FY11\SecAnalysisContosoFY11.xml /quietIdentify

To export the security database and the domain security policies to an inf file, and then import that file to a different database in order to replicate the security policy settings on another computer, type on the page for secedit export

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

To export the security database and the domain security policies to an .inf file, and then to import that file to a different database to replicate the policy settings on another computer, type on the page for secedit import

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg NetworkShare\Policies\SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

And 11 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1685.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.