All Detections

Suspicious Windows Trace ETW Session Tamper Via Logman.EXE

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202509

Detects the execution of "logman" utility in order to disable or delete Windows trace sessions

Sigma