Audit policy or Windows Event Log channel disabled via CLI tooling

1title: Audit policy or Windows Event Log channel disabled via CLI tooling2id: c74dd0b5-5b58-4b9e-beb6-6862f33d3ad53status: experimental4description: |5  AN0535 spans five log sources — service state, an audit-log-cleared event,6  two registry categories and process creation — but only one of those lets a7  single Sigma rule express the *disable* half of the technique's name rather8  than the *clear* half. This rule matches the two command lines the brief's9  description names directly: `auditpol /set ... /success:disable10  /failure:disable`, and `wevtutil sl <channel> /e:false`, the switch that11  turns a channel off rather than emptying it. `wevtutil cl` (clear) and12  Security 1102 are deliberately left out — that observable belongs to13  Indicator Removal: Clear Windows Event Logs (T1070.001), and folding it in14  here would blur the two techniques the same way casual reading of "disable15  or modify" already does. A third selector covers the bluntest form of the16  same behaviour, the EventLog service itself being stopped or reconfigured17  through `sc.exe`/`net.exe`. The registry-key legs (Sysmon 13/14 on the18  EventLog and Autologger keys) and the System 7035 service-state leg are not19  expressed here — each needs its own logsource and its own rule, since20  lib/sigma has no construct for combining logsources in one detection.21  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0187, not hand-written and not tested by its author. Any lab result is on this rule's own page.22references:23  - https://attack.mitre.org/techniques/T1685/00124  - https://attack.mitre.org/detectionstrategies/DET018725author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)26date: 2026-08-1627tags:28  - attack.defense-evasion29  - attack.t1685.00130logsource:31  category: process_creation32  product: windows33detection:34  selection_wevtutil_disable:35    Image|endswith: '\wevtutil.exe'36    CommandLine|contains: '/e:false'37  selection_auditpol_disable:38    Image|endswith: '\auditpol.exe'39    CommandLine|contains:40      - '/success:disable'41      - '/failure:disable'42  selection_service_stop:43    Image|endswith:44      - '\sc.exe'45      - '\net.exe'46      - '\net1.exe'47    CommandLine|contains: 'eventlog'48  condition: 1 of selection*49falsepositives:50  - "Group Policy re-application. A scheduled gpupdate cycle replays the site's audit-policy baseline through auditpol on every domain-joined host, and most real baselines leave several subcategories at success-only or failure-only, so the remaining half of each pair is written as a literal /success:disable or /failure:disable on a normal refresh interval. This is the highest-volume source by a wide margin on a managed domain."51  - "Log-retention and disk-space management tooling that disables noisy diagnostic or operational channels (for example a verbose PowerShell or application-compatibility log) with wevtutil sl ... /e:false as part of a documented baseline, rather than the Security or System channel."52  - "Imaging, sysprep and generalization tooling that stops or reconfigures the EventLog service as one step of a multi-step build process, which is disruptive but sanctioned."53  - "Security baseline and compliance tools (CIS/STIG remediation scripts) that assert an intentionally-disabled subcategory explicitly rather than relying on the existing state, producing the same auditpol command an adversary would run."54level: low