attack.t1685.001

Audit Policy Tampering Via Auditpol

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Read More
Audit Policy Tampering Via NT Resource Kit Auditpol

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.

Read More
Change Winevt Channel Access Permission Via Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.

Read More
Disable Security Events Logging Adding Reg Key MiniNt

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685.001 attack.t1112 car.2022-03-001 ·
Share on:

Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.

Read More
Disable Windows Event Logging Via Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Read More
Disable Windows IIS HTTP Logging

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

Read More
ETW Logging/Processing Option Disabled On IIS Server

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685.001 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

Read More
EVTX Created In Uncommon Location

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting.

Read More
Filter Driver Unloaded Via Fltmc.EXE

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1070 attack.t1685 attack.t1685.001 ·
Share on:

Detect filter driver unloading activity via fltmc.exe

Read More
Forest Blizzard APT - File Creation Activity

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 detection.emerging-threats ·
Share on:

Detects the creation of specific files inside of ProgramData directory. These files were seen being created by Forest Blizzard as described by MSFT.

Read More
Forest Blizzard APT - JavaScript Constrained File Creation

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 detection.emerging-threats ·
Share on:

Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.

Read More
HackTool - SharpEvtMute DLL Load

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

Read More
HackTool - SharpEvtMute Execution

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

Read More
HackTool - SysmonEnte Execution

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon

Read More
HTTP Logging Disabled On IIS Server

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685.001 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

Read More
Important Windows Event Auditing Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.

Read More
New Module Module Added To IIS Server

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685.001 attack.t1505.004 ·
Share on:

Detects the addition of a new module to an IIS server.

Read More
Potential AutoLogger Sessions Tampering

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. The AutoLogger event tracing session records events up that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in, and also used by security solutions as telemetry source. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.

Read More
Potential EventLog File Location Tampering

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting

Read More
Potential Suspicious Activity Using SeCEdit

Apr 28, 2026 · attack.collection attack.discovery attack.persistence attack.credential-access attack.privilege-escalation attack.execution attack.stealth attack.defense-impairment attack.t1685.001 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1685 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Previously Installed IIS Module Was Removed

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685.001 attack.t1505.004 ·
Share on:

Detects the removal of a previously installed IIS module.

Read More
Security Event Logging Disabled via MiniNt Registry Key - Process

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685.001 attack.t1112 car.2022-03-001 ·
Share on:

Detects attempts to disable security event logging by adding the MiniNt registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.

Read More
Security Event Logging Disabled via MiniNt Registry Key - Registry Set

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685.001 attack.t1112 car.2022-03-001 ·
Share on:

Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.

Read More
Suspicious Eventlog Clearing or Configuration Change Activity

Apr 28, 2026 · attack.defense-impairment attack.t1685.005 attack.t1685.001 car.2016-04-002 ·
Share on:

Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses.

Read More
Suspicious Svchost Process Access

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service.

Read More
Sysmon Driver Unloaded Via Fltmc.EXE

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1070 attack.t1685 attack.t1685.001 ·
Share on:

Detects possible Sysmon filter driver unloaded via fltmc.exe

Read More
Windows Event Auditing Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. Also, it is recommended to turn off "Local Group Policy Object Processing" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as "gpedit.msc". Please note, that disabling "Local Group Policy Object Processing" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways.

Read More
Windows EventLog Autologger Session Registry Modification Via CommandLine

Apr 28, 2026 · attack.defense-impairment attack.t1685.001 ·
Share on:

Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing session records events that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.

Read More