Rule Info
Name
New ETW Session Started
Author
Nasreddine Bencherchali (Nextron Systems)
Description
This detection triggers every time a new ETW session is started.
Reference
Internal Research
Date
2024-03-13 00:00:00
Modified
None
Id
58b83b9b-c2d0-4dfd-93f3-3ca3d71d9ba5
Tags
attack.defense_evasion
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR