Log clearing followed by security tool tampering on same endpoint

ills3c Intel&Coffee@Ills3C

•updated 5 days ago•3•0•6

Detects a sequence where an endpoint clears event logs (using wevtutil or PowerShell) and subsequently tampers with or disables security tools (such as Windows Defender or service logging) on the same device within a one-hour window.