Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs
Read the full analysis on IntelFusions