Windows Event Logs Enumerated Remotely via SMB

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects attempts to remotely enumerate Windows Event Logs over SMB. It specifically looks for TCP traffic on port 445 (SMB) where the content includes both "eventlog" and "EvtQuery" (case-insensitive), indicating a query for event log information.