Skip to content
Threat Feed
Subscribe

Tag

Audit-Tampering

4 briefs RSS
high advisory

Detection of Windows Audit Policy Tampering via Event ID 4719

Adversaries may disable critical Windows audit policies to evade detection by monitoring tools, an activity identifiable through the analysis of Event ID 4719.

Windows defense-evasion audit-tampering windows-security
1r 1t
high advisory

ESXi Audit Tampering via esxcli

Attackers use esxcli system auditrecords commands on ESXi hosts to tamper with logging, hindering forensic analysis and detection efforts, potentially leading to prolonged compromise and data breaches.

ESXi audit-tampering defense-evasion vmware
3r 2t
high threat

Windows Audit Policy Cleared via Auditpol

The execution of `auditpol.exe` with the `/clear` or `/remove` command-line arguments indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits, potentially leading to full machine compromise or lateral movement.

Windows +3 defense-evasion audit-tampering
2r 1t
high advisory

ESXi Audit Tampering Detection

Detection identifies the use of the esxcli system auditrecords commands to tamper with logging on an ESXi host, potentially evading detection and hindering forensic analysis.

ESXi +3 vmware audit-tampering defense-evasion
2r 1t