Ransomware Affiliate Event Log Clearing and Browser Credential Theft

Suraj A@cytech

•updated yesterday•0•0•4

Detects Windows process creation activity related to event log clearing via wevtutil or PowerShell (Clear-EventLog) and command-line access to browser credential stores, behaviors commonly associated with ransomware affiliate activity.