Event Log Query Requests By Built-in Utilities
Detects attempts to query the contents of the event log using command line utilities such as `wevtutil.exe`, `wmic.exe`, and PowerShell cmdlets like `Get-WinEvent` or `Get-EventLog`. Attackers use this technique to find sensitive information in logs, such as credentials, usernames, or IP addresses.
Sigma
