Suspicious Windows Trace ETW Session Tamper Via Logman.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects the execution of the "logman" utility to disable or delete Windows trace sessions, which can be used by adversaries for defense evasion by tampering with logging mechanisms like Sysmon or other kernel loggers.