Files
blue-team-tools/rules
Nate Guagenti 60c4fed2e0 Create win_etw_trace_evasion.yml
there are two versions of clear and two variations of set that can be used with something like wevtutil
`wevtutil cl | wevtutil clear-log | wevtutil sl | wevtutil set-log `

Also, I am adding a `*` match at the end, because there are other parameters that could be placed on the end -- so unless this was used on a general search on a text/analyzed field then the `*` is necessary.

example `wevtutil set-log Microsoft-Windows-WMI-Activity/Trace /e:disable /q:true`
2019-03-22 11:36:55 -04:00
..
2019-03-13 10:25:41 +00:00
2018-11-15 08:45:25 +03:00
2019-03-08 16:25:16 +01:00
2019-01-22 08:49:10 +01:00
2019-03-22 11:36:55 -04:00