Windows Security Event Logs Queried [snowflake-crowdstrikefdr_process]

wevtutil.exe is a Windows component used to retrieve information about event logs and publishers. Threat actors such as Mustang Panda have been observed using wevtutil to query Windows event logs to gather information about usernames. This use case detects executions with command line patterns indicating attempts to query Windows Event logs. wevtutil has not been included in detection logic to account for instances where it has been renamed. -- Threat Actor Association: Mustang Panda/Stately Taurus -- LOLBINS/LOLBAS