ETW Trace Evasion Activity

SigmaHQ Detections@sigmaHQ

•updated 16 days ago•0•0•4

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.