| sigma |
EVTX Created In Uncommon Location |
test |
2026-10-13 |
| splunk |
Windows New EventLog ChannelAccess Registry Value Set |
production |
2026-10-02 |
| splunk |
Windows Disable Windows Event Logging Disable HTTP Logging |
production |
2026-10-02 |
| splunk |
Windows PowerShell Disable HTTP Logging |
production |
2026-10-02 |
| splunk |
Windows New Custom Security Descriptor Set On EventLog Channel |
production |
2026-10-02 |
| sigma |
HackTool - SysmonEnte Execution |
test |
2026-06-29 |
| sigma |
Suspicious Eventlog Clearing or Configuration Change Activity |
stable |
2026-06-01 |
| splunk |
Cisco ASA - Logging Message Suppression |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Cleared via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Global Object Access Audit List Cleared Via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Security Descriptor Tampering via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Restored via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Excluded Category via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Disabled via Legacy Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Disabled via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Auditing Option Disabled via Auditpol |
production |
2026-05-13 |
| sigma |
Potential AutoLogger Sessions Tampering |
test |
2025-12-26 |
| sigma |
Windows EventLog Autologger Session Registry Modification Via CommandLine |
experimental |
2025-12-25 |
| sigma |
Filter Driver Unloaded Via Fltmc.EXE |
test |
2025-10-07 |
| sigma |
Security Event Logging Disabled via MiniNt Registry Key - Registry Set |
experimental |
2025-04-09 |
| sigma |
Security Event Logging Disabled via MiniNt Registry Key - Process |
experimental |
2025-04-09 |
| sigma |
HackTool - SharpEvtMute DLL Load |
test |
2024-11-23 |
| sigma |
Previously Installed IIS Module Was Removed |
test |
2024-10-06 |
| sigma |
New Module Module Added To IIS Server |
test |
2024-10-06 |
| sigma |
ETW Logging/Processing Option Disabled On IIS Server |
test |
2024-10-06 |
| sigma |
HTTP Logging Disabled On IIS Server |
test |
2024-10-06 |
| sigma |
Forest Blizzard APT - File Creation Activity |
test |
2024-07-11 |
| sigma |
Forest Blizzard APT - JavaScript Constrained File Creation |
test |
2024-04-23 |
| sigma |
Change Winevt Channel Access Permission Via Registry |
test |
2024-03-25 |
| sigma |
Disable Windows Event Logging Via Registry |
test |
2024-03-25 |
| sigma |
Important Windows Event Auditing Disabled |
test |
2023-11-17 |
| sigma |
Windows Event Auditing Disabled |
test |
2023-11-15 |
| sigma |
Potential EventLog File Location Tampering |
test |
2023-08-17 |
| sigma |
Audit Policy Tampering Via Auditpol |
test |
2023-02-22 |
| sigma |
Audit Policy Tampering Via NT Resource Kit Auditpol |
test |
2023-02-21 |
| sigma |
HackTool - SharpEvtMute Execution |
test |
2023-02-14 |
| sigma |
Sysmon Driver Unloaded Via Fltmc.EXE |
test |
2023-02-13 |
| sigma |
Suspicious Svchost Process Access |
test |
2023-01-30 |
| sigma |
Disable Windows IIS HTTP Logging |
test |
2023-01-22 |
| sigma |
Potential Suspicious Activity Using SeCEdit |
test |
2022-12-30 |
| sigma |
Disable Security Events Logging Adding Reg Key MiniNt |
test |
2021-11-27 |