Activity timeline
T1685.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-05 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.
How adversaries use it
T1685.001 Disable or Modify Windows Event Log is catalogued by MITRE ATT&CK under the Defense Impairment tactic in the Enterprise matrix, as a sub-technique of T1685 Disable or Modify Tools. Threadlinqs maps 10 of 3938 tracked threats (0.3%) to it; by severity that is 3 critical, 7 high.
Threats that use T1685.001 most often also use T1036.005 Match Legitimate Resource Name or Location (7 threats), T1059.001 PowerShell (7 threats), T1082 System Information Discovery (7 threats), T1486 Data Encrypted for Impact (6 threats), T1021.001 Remote Desktop Protocol (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
9 tracked threat actors appear in the threats that use T1685.001; the most frequent are Akira (1), Hyadina (1), INC Ransom (1), INC Ransom - G1032 (1), Lynx (1).
Threat actors using it
Tracked threats
10 tracked threats use T1685.001.
- T-SQL Abused to Deliver XMRig Miner and Gh0st RAT on Compromised MS SQL Servershigh
- NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and…critical
- AtlasRAT: Four-Stage In-Memory Loader Chain Delivers Commercial RAT via Fake Flash Player Installer (Silver…high
- FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644…critical
- GodDamn Ransomware (Hyadina) — Third Rebrand from Monster/Beast, Deploys Signed PoisonX Kernel Driverhigh
- Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow…high
- Payload Ransomware — Babuk-Derivative ChaCha20 + Curve25519 ECDH Per-File Encryption Targeting Windows and…high
- The Gentlemen Ransomware (RaaS) — Defense Evasion TTPs: Event Log Clearing, Defender Disable & AV Exclusions…high
- GIBCRYPTO Destructive Ransomware with Snake Keylogger Shared Telegram C2 Infrastructurecritical
- Tesseract OCR Typosquat Campaign — ClickFix Multi-Stage Malware Targeting Developers via Fake OCR Tool Sites…high
Detection coverage
Threadlinqs maintains 14 detection rules mapped to T1685.001 (SPL 4, KQL 4, Sigma 6). Rule content unlocks with TL Creds on a free account; this page shows counts only.
Parent technique
T1685 Disable or Modify Tools — 939 tracked threats at the technique level.