Application Uninstalled
This rule detects when an application has been uninstalled from a Windows system. It specifically looks for MsiInstaller events with EventIDs 1034 (Windows Installer removed the product) or 11724 (Product Removal Successful). This can be an indicator of an adversary attempting to remove security software or other critical applications to hinder detection or response efforts, or simply to clean up their tracks.
Sigma
