Skip to content
Threat Feed

Product

Windows Event Log

1 brief RSS
high advisory

Windows Event Logging Service Shutdown Detection

Detection of the Windows Event Log service shutdown, indicated by Event ID 1100, which can signify attempts to evade detection by disabling logging.

Splunk Enterprise +3 defense-evasion windows event-logging
2r 1t