Tag
medium
advisory
Suspicious Use of PsLogList for Event Log Discovery and Evasion
1 rule 3 TTPsAdversaries are leveraging the legitimate Sysinternals utility PsLogList to perform account and system discovery by dumping Windows event logs, and for defense evasion by clearing or exporting these logs, increasing their ability to operate undetected and further compromise systems.
sysinternals
discovery
defense-evasion
account-discovery
log-clearing
windows
1r
3t
medium
advisory
Linux Log Clearing Attempts via Common Utilities
3 rules 1 TTPAdversaries attempt to clear Linux system logs using utilities like rm, rmdir, shred, and unlink to conceal malicious activity and evade detection.
defense-evasion
log-clearing
linux
3r
1t