ETW Trace Evasion Activity — Detection Rule
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.