---
title: Security Event Log Service Disruption
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to disrupt security monitoring by stopping or disabling the Windows Event Log service, which creates blind spots for defenders.
references:
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\sc.exe'
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - ' stop EventLog'
      - ' disable EventLog'
      - ' config EventLog start='
falsepositives:
  - Legitimate system maintenance
  - Authorized service reconfiguration
level: high
---
title: Security Channel Log Cleared
id: b7c8d9e0-f1a2-3456-bcde-f01234567890
status: experimental
description: Detects attempts to clear or modify security event logs, which can destroy evidence of malicious activity and create monitoring gaps.
references:
  - https://attack.mitre.org/techniques/T1070/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.defense_evasion
  - attack.t1070.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\wevtutil.exe'
    CommandLine|contains:
      - ' cl '
      - 'clear-log'
      - ' /e:false'
  filter:
    CommandLine|contains:
      - 'Application'
      - 'System'
falsepositives:
  - Authorized log maintenance procedures
  - Automated log rotation scripts
level: high
---
title: Telemetry Collection Agent Stopped
id: 9a8b7c6d-5e4f-3a2b-1c9d-8e7f6a5b4c3d
status: experimental
description: Detects attempts to stop EDR or telemetry collection agents, which can disable visibility for security monitoring systems.
references:
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\taskkill.exe'
      - '\\powershell.exe'
      - '\\cmd.exe'
    CommandLine|contains:
      - 'MsSense.exe'
      - 'SenseCncProxy.exe'
      - 'MsMpEng.exe'
      - 'CbSenforcement.exe'
      - 'CbResponseSensors'
falsepositives:
  - Authorized agent upgrades
  - Legitimate troubleshooting by IT
level: critical

// Identify endpoints with telemetry gaps in the last 4 hours
let TelemetryThreshold = 4h;
DeviceProcessEvents
| where Timestamp > ago(TelemetryThreshold)
| summarize LastEvent = max(Timestamp), EventCount = count() by DeviceId, DeviceName
| where LastEvent < ago(TelemetryThreshold)
| extend TimeSinceLastEvent = datetime_diff('minute', now(), LastEvent)
| project DeviceName, DeviceId, EventCount, TimeSinceLastEvent, LastEvent
| sort by TimeSinceLastEvent desc

// Detect potential security monitoring service disruptions
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ('ServiceStopped', 'ServiceDisabled', 'ServiceDeleted')
| where ServiceName in ('EventLog', 'Sysmon', 'WinDefend', 'Sense')
| project Timestamp, DeviceName, ActionType, ServiceName, InitiatingProcessAccountName, InitiatingProcessFileName
| sort by Timestamp desc

// Identify abnormal gaps in security event collection
SecurityEvent
| where TimeGenerated > ago(24h)
| summarize LastSecurityEvent = max(TimeGenerated) by Computer
| where LastSecurityEvent < ago(4h)
| extend GapDuration = datetime_diff('minute', now(), LastSecurityEvent)
| project Computer, LastSecurityEvent, GapDuration
| sort by GapDuration desc

-- Hunt for endpoints with telemetry collection gaps (systems not reporting events)
SELECT System.Hostname as Hostname,
       OS.Fqdn,
       now() - query(SELECT max(timestamp) as ts FROM pslist()).ts[0] as TimeSinceLastProcessRecord,
       count(query=pslist()) as ProcessCount
FROM info()
WHERE TimeSinceLastProcessRecord > 4h

-- Hunt for security monitoring service configurations
SELECT Name, DisplayName, StartType, State, Path
FROM wmi(query="SELECT * FROM Win32_Service WHERE Name LIKE '%event%' OR Name LIKE '%sysmon%' OR Name LIKE '%defend%'")
WHERE State != "Running" OR StartType = "Disabled"

-- Hunt for potential EDR agent termination attempts
SELECT Pid, Name, CommandLine, Exe, ParentPid, Username, CreateTime
FROM pslist()
WHERE Name =~ "taskkill.exe" OR Name =~ "taskmgr.exe"
   AND (CommandLine =~ "MsSense" OR CommandLine =~ "WinDefend" OR CommandLine =~ "MsMpEng")

<#
.SYNOPSIS
    Verifies comprehensive telemetry coverage across the environment
.DESCRIPTION
    This script checks for potential monitoring gaps and verifies
    that key security telemetry sources are properly configured.
#>

$results = @()
foreach ($channel in $channels) {
    try {
        $log = Get-WinEvent -ListLog $channel.Name -ErrorAction Stop
        $lastEvent = Get-WinEvent -LogName $channel.Name -MaxEvents 1 -ErrorAction SilentlyContinue
        $timeSinceLastEvent = if ($lastEvent) { (Get-Date) - $lastEvent.TimeCreated } else { $null }
        
        $results += [PSCustomObject]@{
            Channel = $channel.Name
            Enabled = $log.IsEnabled
            LogMode = $log.LogMode
            MaxSizeMB = [math]::Round($log.MaximumSizeInBytes / 1MB, 2)
            LastEventTime = if ($lastEvent) { $lastEvent.TimeCreated } else { "Never" }
            HoursSinceLastEvent = if ($timeSinceLastEvent) { [math]::Round($timeSinceLastEvent.TotalHours, 2) } else { "N/A" }
            Required = $channel.Required
            Healthy = ($log.IsEnabled -and (!$timeSinceLastEvent -or $timeSinceLastEvent.TotalHours -lt 24))
        }
    }
    catch {
        $results += [PSCustomObject]@{
            Channel = $channel.Name
            Enabled = $false
            LogMode = "Not Configured"
            MaxSizeMB = 0
            LastEventTime = "Never"
            HoursSinceLastEvent = "N/A"
            Required = $channel.Required
            Healthy = !$channel.Required
        }
    }
}
return $results