-
Suspicious Service was Installed in the System
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Resources: Investigation Guide Data Source: Windows Security Event Logs Data Source: Windows System Event Logs Noise: High Performance: Normal Profile: Aggressive Threat: Ransomware Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies the creation of a new Windows service with a suspicious service name or command value. Windows services typically run as SYSTEM and can be used for privilege escalation and persistence.
Read More -
Windows Event Logs Cleared
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Resources: Investigation Guide Data Source: Windows Security Event Logs Data Source: Windows System Event Logs Noise: High Performance: Normal Profile: Aggressive Rule Type: Custom Query (KQL) Platform: Windows ·Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.
Read More