SharpEvtMute DLL Load Detection by IMPHASH
Detects the loading of 'EvtMuteHook.dll' based on its unique IMPHASH. This DLL is a component of SharpEvtHook/EvtMute, a tool designed to tamper with Windows event logs to evade detection. The rule specifically looks for the known IMPHASH of this malicious DLL.
Sigma
