Potentially Suspicious Call To Win32_NTEventlogFile Class

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script