Windows Event Logging Service Auto-Start Disabled

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects service configuration modifications of event logging service to disable it. Windows Event Logging service is responsible for logging system events, that are critical for security monitoring and auditing. Disabling this service can prevent the logging of important security events, making it a potential indicator of malicious activity. Adversaries may use this technique to limit data available for detection and audits.

2025-04-09 00:00:00

None

c8c0599a-4b19-493a-9ab8-89c5dd64e9cd

attack.defense-evasion attack.t1562.002 car.2022-03-001

Nextron Sigma feed only (private)