How to defend against logging turned off from the command line

What the attacker does

Besides the registry, an attacker with administrator rights turns logging off from the command line with built-in tools. auditpol.exe clears the whole audit policy (/clear) or disables categories (/set ... :disable), so Windows stops recording the chosen events. wevtutil.exe clears a log (cl) or points it at a throwaway file (sl ... /lf). Creating the registry key HKLM\SYSTEM\CurrentControlSet\Control\MiniNt makes Windows behave as if it were running in a preinstallation environment, where the Security log is not written at all; reg add on that key, or on the EventLog service key, does it.

What it looks like in the logs

A process creation event for one of those tools, with the action on the command line. This is one of the commands in the recordings:

auditpol /clear and auditpol /remove remove audit settings; auditpol /set ... :disable turns a category off. The reg add ...\Control\MiniNt command creates the key that silences the Security log.

Detect

Measured on the challenge data: the rule caught 10 of 10 attack events and matched 0 of 2,301 normal events.

title: auditpol, wevtutil or reg.exe used to turn off logging
id: 8c31f786-1e40-436a-be55-9e5cb5fcfc7b
status: test
description: >
  Detects the command-line tools that disable logging: auditpol clearing or disabling the audit
  policy, wevtutil clearing or redirecting a log, and reg.exe writing the EventLog service key or
  creating the MiniNt key. reg.exe runs for many reasons, so it matches only on these two targets.
references:
  - https://attack.mitre.org/techniques/T1562/002/
  - https://howdefend.com/defend/disable-logging-commands/
author: Bartu Kılıç
date: 2026-10-20
tags:
  - attack.defense-evasion
  - attack.t1562.001
  - attack.t1562.002
logsource:
  product: windows
  category: process_creation
detection:
  auditpol:
    Image|endswith: '\auditpol.exe'
    CommandLine|contains:
      - 'disable'
      - '/clear'
      - '/remove'
  wevtutil:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains:
      - ' sl '
      - 'set-log'
      - ' cl '
      - 'clear-log'
  reg_eventlog:
    Image|endswith: '\reg.exe'
    CommandLine|contains: '\services\eventlog'
  reg_minint:
    Image|endswith: '\reg.exe'
    CommandLine|contains: '\control\minint'
  condition: 1 of them
falsepositives:
  - An administrator clearing a log on purpose; correlate with a change ticket
level: high

What the rule misses

• The same result through the registry. Disabling the EventLog service by its Start value and moving the log file are registry writes, caught on the separate registry page, not here.
• A renamed tool or a script module. The rule keys on the built-in program names and their switches. PowerShell's Clear-EventLog, or a copy of wevtutil.exe under another name, needs its own coverage.
• A legitimate clear. An administrator sometimes clears a log on purpose. Correlate the alert with a change record rather than treating every clear as an attack, but keep the alert: the record of the clear is itself worth having.

Prevent

• Forward events as they happen. If events leave the host as they are written, clearing a log locally does not remove what was already collected.
• Alert on the silence and on the MiniNt key. A machine that stops sending events, or any write to the MiniNt key, is a high-quality signal; nothing legitimate creates that key on a running machine.
• Fewer administrators. Each tool here needs administrator rights, so limiting local administrators limits who can run them.

Practice

Write the rule yourself on the same data, with every target labelled.

Sources

• MITRE ATT&CK: T1562.002 Disable Windows Event Logging
• MITRE ATT&CK: T1562.001 Disable or Modify Tools
• OTRF Security-Datasets (attack recordings used on this page)