Concept
concept:windows_event_logs
Also: event logs
Windows audit records treated as important evidence whose contents can be selectively altered by the released exploit.
Windows audit records treated as important evidence whose contents can be selectively altered by the released exploit.
“Windows event logs are so important to us.”
“There’s also a capability of removing individual events.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | AFFECTS | Windows event log editing exploit | Explicit | 53 |
Windows event log editing exploit AFFECTS Windows event logs
The exploit can disable logging without creating an event and remove individual Windows events.
Explicit Confidence 97% · Jack Rhysider EP 53 Details
“you can disable logging without an event indicating logging has been turned off”