Suspicious Attempts to Disable Windows Event Logging Service - Powershell

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to disable Windows Event Logging service through PowerShell using CimInstance or WmiObject or Set-Service. The Event Logging service is responsible for logging system events in Windows, which is critical for security monitoring and auditing. Disabling this service can prevent the logging of important security events, making it a potential indicator of malicious activity. Adversaries may use this technique to limit data available for detection and audits.

2025-04-09 00:00:00

None

7a297541-68c5-4c8f-b3b4-8f8e81953ba9

attack.defense-evasion attack.t1562.002 car.2022-03-001

Nextron Sigma feed only (private)