Rule Info
Name
USN Journal Deleted By Uncommon Process
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the deletion of a USN journal by an uncommon process.
Reference
Internal Research
Date
2024-01-24 00:00:00
Modified
None
Id
26c1c422-d202-4000-89e5-92d43a4cab23
Tags
attack.defense_evasion
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR