How to defend against logging turned off through the registry

What the attacker does

Windows decides from the registry whether it keeps logging. An attacker with administrator rights changes a few values to go quiet: setting the EventLog service Start value to 4 stops the service at the next boot; moving the Security log file path points new records at a file the attacker controls; and setting ProcessCreationIncludeCmdLine_Enabled to 0 removes the command line from process creation events, so later commands still log but without their arguments. The change usually happens early, so that the rest of the attack is recorded thinly or not at all.

What it looks like in the logs

A registry value set event (Sysmon Event ID 13, category: registry_set): TargetObject is the value's path, Details what was written, Image the program that wrote it. This is one of the writes in the recordings:

The EventLog service is disabled when its Start value becomes DWORD (0x00000004). The writes come from reg.exe, from PowerShell and from a dropped executable, which is why the program alone does not separate them from normal activity.

Detect

Measured on the challenge data: the rule caught 6 of 6 attack events and matched 0 of 11,082 normal events.

title: Registry write that disables event logging or the command line in process events
id: 7d950be9-2685-4a1e-9b98-3957b21e4c07
status: test
description: >
  Detects writes to registry values that weaken logging: the EventLog service Start value set to 4
  (service disabled at next boot), a change to the Security log file path, and
  ProcessCreationIncludeCmdLine_Enabled set to 0 (command line dropped from process events). These
  keys change during an OS install or update; a write at any other time is worth an alert.
references:
  - https://attack.mitre.org/techniques/T1562/002/
  - https://howdefend.com/defend/disable-logging-registry/
author: Bartu Kılıç
date: 2026-10-20
tags:
  - attack.defense-evasion
  - attack.t1562.002
  - attack.t1562.006
logsource:
  product: windows
  category: registry_set
detection:
  eventlog_disabled:
    TargetObject|endswith: '\Services\EventLog\Start'
    Details: 'DWORD (0x00000004)'
  log_file_moved:
    TargetObject|contains: '\Services\EventLog\'
    TargetObject|endswith: '\File'
  cmdline_off:
    TargetObject|endswith: '\ProcessCreationIncludeCmdLine_Enabled'
    Details: 'DWORD (0x00000000)'
  condition: 1 of them
falsepositives:
  - An OS install or feature update that rewrites the EventLog service configuration
level: high

What the rule misses

• Other ways to the same end. The MiniNt key, auditpol and wevtutil reach the same result without these three values; they run on the command line and are a separate challenge and page.
• Per-channel logging turned off. Each event channel has its own Enabled value; an attacker can disable one channel (PowerShell, Sysmon) without touching the EventLog service. Watch the channel keys too.
• The install-time false positive. A Windows install or feature update legitimately rewrites the EventLog service configuration. Treat a write on a running, already-installed machine differently from one during setup.

Prevent

• Forward events as they happen. Windows Event Forwarding or an agent that ships events off the host means a log turned off locally does not remove what was already collected.
• Alert on the silence. A machine that was sending events and stops is itself a signal, whichever value was changed.
• Protect the keys. These values are writable only by administrators; fewer local administrators means fewer accounts that can change them.

Practice

Write the rule yourself on the same data, with every target labelled.

Sources

• MITRE ATT&CK: T1562.002 Disable Windows Event Logging
• Microsoft Learn: Command line process auditing
• OTRF Security-Datasets (attack recordings used on this page)