Sagan unknown stable other

[WINDOWS-SYSMON] Windows Event Log Cleared

[WINDOWS-SYSMON] Windows Event Log Cleared

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Windows Event Log Cleared"; program:Sysmon; content:"wevtutil cl"; classtype:credential-access; sid:5015515; rev:1; metadata:created_at 2025_03_06, updated_at 2025_03_06, mitre_tactic_id TA0005, mitre_technique_id T1070;)

Field Validations

Loading…

Comments (0)

Loading comments...