Skip to content
Threat Feed

Product

Windows Event Log Security

2 briefs RSS
high advisory

Windows Attempt to Stop Security Service

An attacker attempts to stop security services on a Windows endpoint using sc.exe, net.exe, or PowerShell Stop-Service cmdlet to weaken defenses for further malicious activity.

Windows Event Log Security +1 defense-evasion endpoint windows
2r 1t
high advisory

Windows AD Domain Controller Audit Policy Disabled

Detection of disabled audit policies on a Windows domain controller by monitoring Windows Security Event Logs for EventCode 4719, indicative of an attacker attempting to evade detection and potentially leading to data theft, privilege escalation, and full network compromise.

Windows Event Log Security +3 defense-evasion windows
2r 1t