Threat Hunt: Event Log Manipulation Attempts

Awais Munir@iawais

•updated Aug 5, 2025•7•3•118

This KQL query hunts for suspicious activities in Microsoft Defender for Endpoint that may indicate attempts to disable or manipulate Windows Event Logging, such as clearing logs, stopping the Event Log service, or modifying audit policies. It targets processes and commands associated with MITRE ATT&CK technique T1562.002 to identify potential defense evasion tactics.