Stop EventLog
Stop EventLog
Sigma rule (View on GitHub)
1title: Stop EventLog
2status: experimental
3description: Stop EventLog
4author: Joe Security
5date: 2024-03-11
6id: 200116
7threatname:
8behaviorgroup: 7
9classification: 8
10mitreattack:
11
12logsource:
13 category: process_creation
14 product: windows
15detection:
16 selection:
17 CommandLine:
18 - '*sc.exe stop eventlog'
19
20 condition: selection
21level: critical