Disable Windows Event Logging Via Registry

{
  "registry_set": {
    "EventID": 4657,
    "Channel": "Security"
  },
  "selection": {
    "ObjectName
| contains": "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\",
    "ObjectName
| endswith": "\\Enabled",
    "NewValue": "DWORD (0x00000000)"
  },
  "filter_main_wevutil": {
    "ProcessName": "C:\\Windows\\system32\\wevtutil.exe"
  },
  "filter_main_iis": {
    "ProcessName
| startswith": "C:\\Windows\\winsxs\\",
    "ProcessName
| endswith": "\\TiWorker.exe"
  },
  "filter_main_svchost": {
    "ProcessName": "C:\\Windows\\System32\\svchost.exe",
    "ObjectName
| contains": [
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-FileInfoMinifilter",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-ASN1\\",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Kernel-AppCompat\\",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Runtime\\Error\\",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-CAPI2/Operational\\"
    ]
  },
  "filter_main_trusted_installer": {
    "ProcessName": "C:\\Windows\\servicing\\TrustedInstaller.exe",
    "ObjectName
| contains": "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Compat-Appraiser"
  },
  "filter_optional_empty": {
    "ProcessName": ""
  },
  "filter_optional_null": {
    "ProcessName": null
  },
  "condition": "registry_set and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting