ATT&CK technique
View on MITRE ATT&CK →
T1562.002
Disable Windows Event Logging
Stealth
deprecated
5 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Sensitive Audit Policy Sub-Category Disabled | production | 2026-10-19 |
| elastic | Clearing Windows Event Logs | production | 2026-09-18 |
| elastic | PowerShell Script Block Logging Disabled | production | 2026-09-18 |
| elastic | Disable Windows Event and Security Logs Using Built-in Tools | production | 2026-09-18 |
| elastic | IIS HTTP Logging Disabled | production | 2026-09-18 |