Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Техника Отключение журналирования событий Windows
Сертификаты СЗИ
CVE уязвимости
БДУ ФСТЭК уязвимости
НКЦКИ уязвимости
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
EN
Риски
Каталоги
MITRE ATT&CK
Техника
Отключение журналирования собы...
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Impair Defenses:  Отключение журналирования событий Windows

ID Название
.001 Отключение или перенастройка средств защиты
.002 Отключение журналирования событий Windows
.003 Повреждение журнала истории команд
.004 Отключение или перенастройка системного межсетевого экрана
.006 Блокировка сбора признаков активности
.007 Отключение или перенастройка облачного межсетевого экрана
.008 Disable or Modify Cloud Logs
.009 Загрузка в безопасном режиме
.010 Атака через понижение версии
.011 Spoof Security Alerting
.012 Disable or Modify Linux Audit System

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections. The EventLog service maintains event logs from various system components and applications.(Citation: EventLog_Core_Technologies) By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.(Citation: Audit_Policy_Microsoft)(Citation: Advanced_sec_audit_policy_settings) auditpol.exe may also be used to set audit policies.(Citation: auditpol) Adversaries may target system-wide logging or just that of a particular application. For example, the Windows EventLog service may be disabled using the Set-Service -Name EventLog -Status Stopped or sc config eventlog start=disabled commands (followed by manually stopping the service using Stop-Service -Name EventLog).(Citation: Disable_Win_Event_Logging)(Citation: disable_win_evt_logging) Additionally, the service may be disabled by modifying the “Start” value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog then restarting the system for the change to take effect.(Citation: disable_win_evt_logging) There are several ways to disable the EventLog service via registry key modification. First, without Administrator privileges, adversaries may modify the "Start" value in the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security, then reboot the system to disable the Security EventLog.(Citation: winser19_file_overwrite_bug_twitter) Second, with Administrator privilege, adversaries may modify the same values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application to disable the entire EventLog.(Citation: disable_win_evt_logging) Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. For example, auditpol /set /category:”Account Logon” /success:disable /failure:disable turns off auditing for the Account Logon category.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.(Citation: T1562.002_redcanaryco) By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.

ID: T1562.002
Относится к технике:  T1562
Тактика(-и): Defense Evasion
Платформы: Windows
Источники данных: Application Log: Application Log Content, Command: Command Execution, Process: Process Creation, Script: Script Execution, Sensor Health: Host Status, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Версия: 1.3
Дата создания: 21 Feb 2020
Последнее изменение: 18 Sep 2023

Примеры процедур
Название Описание
Wevtutil

Wevtutil can be used to disable specific event logs on the system.(Citation: Wevtutil Microsoft Documentation)
Threat Group-3390

Threat Group-3390 has used appcmd.exe to disable logging on a victim server.(Citation: SecureWorks BRONZE UNION June 2017)
Magic Hound

Magic Hound has executed scripts to disable the event log service.(Citation: DFIR Phosphorus November 2021)

During the SolarWinds Compromise, APT29, used `AUDITPOL` to prevent the collection of audit logs.(Citation: Microsoft Deep Dive Solorigate January 2021)
APT29

APT29 used AUDITPOL to prevent the collection of audit logs.(Citation: Microsoft Deep Dive Solorigate January 2021)

During HomeLand Justice, threat actors deleted Windows events and application logs.(Citation: Microsoft Albanian Government Attacks September 2022)

During the 2016 Ukraine Electric Power Attack, Sandworm Team disabled event logging on compromised systems.(Citation: Dragos Crashoverride 2018)
Sandworm Team

Sandworm Team has disabled event logging on compromised systems.(Citation: Dragos Crashoverride 2018)
UNC2452

UNC2452 used AUDITPOL to prevent the collection of audit logs.(Citation: Microsoft Deep Dive Solorigate January 2021)

Контрмеры
Контрмера Описание
Restrict File and Directory Permissions

Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
Restrict Registry Permissions

Restrict the ability to modify certain hives or keys in the Windows Registry.
Audit

Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
User Account Management

Manage the creation, modification, use, and permissions associated to user accounts.

Обнаружение

Monitor processes and command-line arguments for commands that can be used to disable logging. For example, Wevtutil, `auditpol`, `sc stop EventLog`, and offensive tooling (such as Mimikatz and `Invoke-Phant0m`) may be used to clear logs.(Citation: def_ev_win_event_logging)(Citation: evt_log_tampering) In Event Viewer, Event ID 1102 under the “Security” Windows Log and Event ID 104 under the “System” Windows Log both indicate logs have been cleared.(Citation: def_ev_win_event_logging) `Service Control Manager Event ID 7035` in Event Viewer may indicate the termination of the EventLog service.(Citation: evt_log_tampering) Additionally, gaps in the logs, e.g. non-sequential Event Record IDs, may indicate that the logs may have been tampered. Monitor the addition of the MiniNT registry key in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control`, which may disable Event Viewer.(Citation: def_ev_win_event_logging)

Ссылки

  1. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
  2. Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.
  3. svch0st. (2020, September 30). Event Log Tampering Part 1: Disrupting the EventLog Service. Retrieved September 14, 2021.
  4. STRONTIC. (n.d.). auditpol.exe. Retrieved September 9, 2021.
  5. Simpson, D. et al. (2017, April 19). Advanced security audit policy settings. Retrieved September 14, 2021.
  6. redcanaryco. (2021, September 3). T1562.002 - Disable Windows Event Logging. Retrieved September 13, 2021.
  7. Naceri, A. (2021, November 7). Windows Server 2019 file overwrite bug. Retrieved April 7, 2022.
  8. Jason Gerend, et al. (2017, October 16). auditpol. Retrieved September 1, 2021.
  9. Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.
  10. Franklin Smith. (n.d.). Windows Security Log Events. Retrieved February 21, 2020.
  11. Daniel Simpson. (2017, April 19). Audit Policy. Retrieved September 13, 2021.
  12. Core Technologies. (2021, May 24). Essential Windows Services: EventLog / Windows Event Log. Retrieved September 14, 2021.
  13. Chandel, R. (2021, April 22). Defense Evasion: Windows Event Logging (T1562.002). Retrieved September 14, 2021.
  14. dmcxblue. (n.d.). Disable Windows Event Logging. Retrieved September 10, 2021.
  15. Forensics Wiki. (2021, June 19). Windows XML Event Log (EVTX). Retrieved September 13, 2021.
  16. Microsoft. (n.d.). wevtutil. Retrieved September 14, 2021.
  17. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
  18. DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.
  19. MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024.
Навигация

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.