# T1685.001 Disable or Modify Windows Event Log > As of 2026-11-14, T1685.001 (Disable or Modify Windows Event Log) appears in 10 tracked threats, first reported 2026-03-01 and most recently 2026-11-12, with linked actors including Akira, Hyadina, INC Ransom; it most often appears alongside T1036.005 (Match Legitimate Resource Name or Location). - **Tracked threats:** 10 (3 critical, 7 high) - **First seen:** 2026-03-01 - **Last seen:** 2026-11-12 - **Threat actors:** 9 - **Detection rules:** 14 (counts only; unlock with TL Creds) ## Key facts - **ID:** T1685.001 - **Framework:** MITRE ATT&CK - **Tactics:** Defense Impairment - **Matrix:** Enterprise - **Parent:** T1685 - **Data as of:** 2026-11-14 - **MITRE:** https://attack.mitre.org/techniques/T1685/001/ ## Activity timeline T1685.001 first appeared in tracked threats on 2026-03-01 and was most recently reported on 2026-11-12. The busiest month was 2026-05 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11. ## How adversaries use it T1685.001 Disable or Modify Windows Event Log is catalogued by MITRE ATT&CK under the Defense Impairment tactic in the Enterprise matrix, as a sub-technique of [T1685 Disable or Modify Tools](https://intel.threadlinqs.com/technique/T1685). Threadlinqs maps 10 of 3938 tracked threats (0.3%) to it; by severity that is 3 critical, 7 high. Threats that use T1685.001 most often also use [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (7 threats), [T1059.001 PowerShell](https://intel.threadlinqs.com/technique/T1059.001) (7 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (7 threats), [T1486 Data Encrypted for Impact](https://intel.threadlinqs.com/technique/T1486) (6 threats), [T1021.001 Remote Desktop Protocol](https://intel.threadlinqs.com/technique/T1021.001) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 9 tracked threat actors appear in the threats that use T1685.001; the most frequent are [Akira](https://intel.threadlinqs.com/actor/Akira) (1), [Hyadina](https://intel.threadlinqs.com/actor/Hyadina) (1), [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) (1), [INC Ransom - G1032](https://intel.threadlinqs.com/actor/INC%20Ransom%20-%20G1032) (1), [Lynx](https://intel.threadlinqs.com/actor/Lynx) (1). ## Threat actors using it - [Akira](https://intel.threadlinqs.com/actor/Akira) — 1 - [Hyadina](https://intel.threadlinqs.com/actor/Hyadina) — 1 - [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) — 1 - [INC Ransom - G1032](https://intel.threadlinqs.com/actor/INC%20Ransom%20-%20G1032) — 1 - [Lynx](https://intel.threadlinqs.com/actor/Lynx) — 1 - [NightEagle](https://intel.threadlinqs.com/actor/NightEagle) — 1 - [Storm-1567](https://intel.threadlinqs.com/actor/Storm-1567) — 1 - [The Gentlemen](https://intel.threadlinqs.com/actor/The%20Gentlemen) — 1 - [Void Arachne](https://intel.threadlinqs.com/actor/Void%20Arachne) — 1 ## Tracked threats 10 tracked threats use T1685.001. - [T-SQL Abused to Deliver XMRig Miner and Gh0st RAT on Compromised MS SQL Servers](https://intel.threadlinqs.com/threat/TL-2026-5864) — high — 2026-11-12 - [NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and…](https://intel.threadlinqs.com/threat/TL-2026-2606) — critical — 2026-09-21 - [AtlasRAT: Four-Stage In-Memory Loader Chain Delivers Commercial RAT via Fake Flash Player Installer (Silver…](https://intel.threadlinqs.com/threat/TL-2026-1344) — high — 2026-07-15 - [FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644…](https://intel.threadlinqs.com/threat/TL-2026-1232) — critical — 2026-07-11 - [GodDamn Ransomware (Hyadina) — Third Rebrand from Monster/Beast, Deploys Signed PoisonX Kernel Driver](https://intel.threadlinqs.com/threat/TL-2026-1148) — high — 2026-07-09 - [Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow…](https://intel.threadlinqs.com/threat/TL-2026-0610) — high — 2026-05-27 - [Payload Ransomware — Babuk-Derivative ChaCha20 + Curve25519 ECDH Per-File Encryption Targeting Windows and…](https://intel.threadlinqs.com/threat/TL-2026-0587) — high — 2026-05-26 - [The Gentlemen Ransomware (RaaS) — Defense Evasion TTPs: Event Log Clearing, Defender Disable & AV Exclusions…](https://intel.threadlinqs.com/threat/TL-2026-0555) — high — 2026-05-21 - [GIBCRYPTO Destructive Ransomware with Snake Keylogger Shared Telegram C2 Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-0210) — critical — 2026-03-11 - [Tesseract OCR Typosquat Campaign — ClickFix Multi-Stage Malware Targeting Developers via Fake OCR Tool Sites…](https://intel.threadlinqs.com/threat/TL-2026-0162) — high — 2026-03-01 ## Related CVEs CVEs referenced by the tracked threats that use T1685.001, most frequent first. - [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379) - [CVE-2019-0708](https://intel.threadlinqs.com/cve/CVE-2019-0708) - [CVE-2020-0688](https://intel.threadlinqs.com/cve/CVE-2020-0688) - [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684) - [CVE-2022-41328](https://intel.threadlinqs.com/cve/CVE-2022-41328) - [CVE-2022-42475](https://intel.threadlinqs.com/cve/CVE-2022-42475) - [CVE-2023-20269](https://intel.threadlinqs.com/cve/CVE-2023-20269) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997) - [CVE-2023-48788](https://intel.threadlinqs.com/cve/CVE-2023-48788) - [CVE-2024-20481](https://intel.threadlinqs.com/cve/CVE-2024-20481) - [CVE-2024-21762](https://intel.threadlinqs.com/cve/CVE-2024-21762) - [CVE-2024-23113](https://intel.threadlinqs.com/cve/CVE-2024-23113) - [CVE-2024-37085](https://intel.threadlinqs.com/cve/CVE-2024-37085) - [CVE-2024-40766](https://intel.threadlinqs.com/cve/CVE-2024-40766) - [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591) - [CVE-2025-59718](https://intel.threadlinqs.com/cve/CVE-2025-59718) - [CVE-2025-59719](https://intel.threadlinqs.com/cve/CVE-2025-59719) - [CVE-2025-68686](https://intel.threadlinqs.com/cve/CVE-2025-68686) - [CVE-2026-24858](https://intel.threadlinqs.com/cve/CVE-2026-24858) - [CVE-2026-25815](https://intel.threadlinqs.com/cve/CVE-2026-25815) ## Detection coverage Threadlinqs maintains 14 detection rules mapped to T1685.001 (SPL 4, KQL 4, Sigma 6). Rule content unlocks with TL Creds on a free account; this page shows counts only. 14 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds ## Parent technique [T1685 Disable or Modify Tools](https://intel.threadlinqs.com/technique/T1685) — 939 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1685.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp