Data Source: Windows System Event Logs | Detection.FYI

Suspicious Service was Installed in the System

Feb 19, 2025 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Resources: Investigation Guide Data Source: Windows Security Event Logs Data Source: Windows System Event Logs ·
Share on:

Identifies the creation of a new Windows service with suspicious Service command values. Windows services typically run as SYSTEM and can be used for privilege escalation and persistence.

Read More
Windows Event Logs Cleared

Feb 19, 2025 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Resources: Investigation Guide Data Source: Windows Security Event Logs Data Source: Windows System Event Logs ·
Share on:

Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.

Read More