Skip to content
Threat Feed

Tag

Audit-Tampering

2 briefs RSS
high threat

Windows Audit Policy Cleared via Auditpol

The execution of `auditpol.exe` with the `/clear` or `/remove` command-line arguments indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits, potentially leading to full machine compromise or lateral movement.

Windows +3 defense-evasion audit-tampering
2r 1t
high advisory

ESXi Audit Tampering Detection

Detection identifies the use of the esxcli system auditrecords commands to tamper with logging on an ESXi host, potentially evading detection and hindering forensic analysis.

ESXi +3 vmware audit-tampering defense-evasion
2r 1t