Disable Windows Event Logging Via Registry

{
  "selection": {
    "TargetObject
| contains": "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\",
    "TargetObject
| endswith": "\\Enabled",
    "Details": "DWORD (0x00000000)"
  },
  "filter_main_wevutil": {
    "Image": "C:\\Windows\\system32\\wevtutil.exe"
  },
  "filter_main_iis": {
    "Image
| startswith": "C:\\Windows\\winsxs\\",
    "Image
| endswith": "\\TiWorker.exe"
  },
  "filter_main_svchost": {
    "Image": "C:\\Windows\\System32\\svchost.exe",
    "TargetObject
| contains": [
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-FileInfoMinifilter",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-ASN1\\",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Kernel-AppCompat\\",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Runtime\\Error\\",
      "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-CAPI2/Operational\\"
    ]
  },
  "filter_main_trusted_installer": {
    "Image": "C:\\Windows\\servicing\\TrustedInstaller.exe",
    "TargetObject
| contains": "\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Compat-Appraiser"
  },
  "filter_optional_empty": {
    "Image": ""
  },
  "filter_optional_null": {
    "Image": null
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

False Positives

• ⚠ Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting