HackTool - SharpEvtMute Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the execution of SharpEvtMute, a hack tool designed to tamper with Windows event logs. The rule identifies the tool by its executable name, description, or specific command-line arguments used to filter or encode event log manipulation commands.