Suspicious Use of PsLogList

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2026•0•0•1

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs