Disable Windows Event Log and Timestomp

Sophisticated threat actors like APT29 will use the techniques Disable Windows Event Logging and Timestomp for defense evasion to prevent defenders from seeing their presence on the network. You will detect this nefarious activity in our virtual lab so you can react to advanced attackers and outsmart them.

Course Content

Course Description

Defense Evasion is the general group of techniques used to avoid detection and hamper analysis. This course will focus on the techniques Disable Windows Event Logging and Timestomp. Publicly available threat intelligence suggests that APT29 has made use of these techniques.

Event Logs are the most commonly available source of log files on Windows systems. They may contain both explicit security alerts, as well as telemetry that can be used for additional detection analytics. Many common adversary TTPs leave artifacts in the Event Logs, making them an especially valuable source of information for defenders. These artifacts also make it dangerous for adversaries such as APT29 that want to avoid detection and maintain persistence. In such situations, adversaries may elect to deploy the Disable Windows Event Logging sub-technique in order to hide traces of their presence.

Adversaries also may use the technique called Timestomp, which is where adversaries change existing time stamps on files in order to hide their tracks. This type of thing will hamper forensic analysis of the target system, during which investigators may use file system date/time stamps to identify any files that were established or changed on a target system around the time frame of other, known unauthorized activity.

Learn how to detect and mitigate these techniques to protect your organization from this highly sophisticated type of attack.

Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to the tactics and techniques used by the threat group APT29. Prevent adversaries from accomplishing the tactic of defense evasion.

This course is part of a Career Path:
No items found.

Instructed by

Master Instructor
Matthew Mullins

Matt has led multiple Red Team engagements, ranging from a few weeks to a year and covering multiple security domains. Outside of Red Teaming, Matt is also a seasoned penetration tester with interests in: AppSec, OSINT, Hardware, Wifi, Social Engineering, and Physical Security. Matt has a Master's degree in Information Assurance and an exhaustive number of certifications ranging from frameworks, management, and hands-on hacking. Matt is a Technical SME at Cybrary, focusing on Adversarial Emulation and Red Teaming for course content.

Chris Daywalt

After too many years of security operations work, Chris Daywalt tries to turn his phone off at 5:00 pm EST. While there are a bunch of training classes and education somewhere on his resume, much of what he has to teach was learned at the school of hard knocks, often at the expense of his previous clients. He wants to help you spend more time detecting and denying adversaries and less time banging your head against your keyboard. He dips his blueberry donuts in orange juice.

Chris’ 19-year career includes work for organizations of all sizes, both government and private sector, and is distributed roughly like so:

  • 30% doing DFIR
  • 30% teaching DFIR
  • 20% monitoring and detection engineering
  • 15% risk assessment
  • 5% other stuff, like sneaking in a game of Plants vs. Zombies or taking a quick nap at the desk (Don’t judge - I work overtime)

    Cybrary Logo
    Certification Body
    Certificate of Completion

    Complete this entire course to earn a Disable Windows Event Log and Timestomp Certificate of Completion