One Day Sec

Does bypassing Windows Event Log affect all logging, and what are its limitations?

No, the bypass only disables the Windows Event Log (the classic event logs under Application, Security, Setup, System, and Forwarded Events). Other logs such as Application and Service Logs (e.g., Windows PowerShell logs) remain active because they are managed by separate services. The article also notes that installing Sysmon can extend logging, and bypasses for Sysmon exist separately. For more on evading SSH logs, see Penetration Basics - Bypassing SSH Logs.
limitationsSysmonWindows Event LogPowerShell logs

Browse all Q&A →