Registry Modification to Disable Event Logging - Process

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to modify Windows Event Logging registry keys, which could indicate an adversary trying to disable system event logging. This is a common defense evasion technique where attackers try to prevent their activities from being logged by disabling the Windows Event Logging service. A successful attack would significantly impair system auditing and security monitoring capabilities.

2025-04-09 00:00:00

None

ea20cf1b-d402-4942-a50d-4418c1693dea

attack.defense-evasion attack.t1562.002 car.2022-03-001

Nextron Sigma feed only (private)