Skip to content
Threat Feed
Subscribe

Tag

Log-Manipulation

5 briefs RSS
medium advisory

Detection of Windows Event Log Service Shutdown

Attackers often terminate the Windows Event Log service, documented via Event ID 1100, to disrupt auditing and obscure malicious post-exploitation activities.

Windows defense-evasion log-manipulation endpoint-security
1r 1t
high advisory

Detection of Windows Event Log Clearing

Detection of Windows Security Event ID 1102 or System Event ID 104 indicates an attempt to disrupt forensic logging and cover tracks after system compromise.

Windows defense-evasion log-manipulation windows-security
1r 1t
high advisory

Authorization Bypass in Klever-Go KleverUpdateAccountPermission Built-in

An authorization flaw in the Klever-Go VM allows attackers to execute an account takeover by leveraging an incorrectly validated RecipientAddr parameter during indirect smart contract calls.

klever-go +2 blockchain smart-contract vulnerability privilege-escalation log-manipulation unauthenticated-access websocket-vulnerability consensus-failure +6
1r 7t updated
medium advisory

Suspicious wevtutil.exe Usage for Event Log Clearing

Attackers frequently abuse the built-in 'wevtutil.exe' utility to clear Windows event logs, a common defense evasion technique used to disrupt forensic investigations and hide post-compromise activity.

defense-evasion log-manipulation windows-security
1r 1t
high advisory

Suspicious Wevtutil Usage for Clearing Windows Event Logs

Detection of wevtutil.exe being used with parameters to clear event logs, indicating potential attempts to evade detection and hinder forensic investigations by adversaries.

Splunk Enterprise +2 defense-evasion windows log-manipulation
2r