Defense Evasion via Event Log and Audit Policy Manipulation
Identify potential defense evasion activity where attackers abuse built-in Windows administration tools to stop services, clear logs, or modify auditing and security controls.
CQL
Identify potential defense evasion activity where attackers abuse built-in Windows administration tools to stop services, clear logs, or modify auditing and security controls.
Already have an account?