
Anti-Forensic
Technique Name | Technique ID's | Has Snippet(s) | Has Rules(s) |
---|---|---|---|
Clear Windows Event Logs | T1070.001 U0302 | ||
Wiping or Encrypting | U0301 | ||
Timestomp | U0303 T1070.006 | ||
Killing Windows Event Log | U0304 | ||
Volume Shadow Copy Service (VSC,VSS) Deletion | U0305 T1070.004 | ||
Disabling Event Tracing for Windows (ETW) | U0306 | ||
Windows Event Log Evasion via Native APIs | U0307 |