Disabling Windows Defender WMI Autologger Session via Reg.exe

심각도 높음 Sigma 탐지 룰. Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By s…

작성자: Matt Anderson (Huntress) · 원본 라이선스: DRL 1.1 · SigmaHQ 원본