Potential Persistence Via Event Viewer Events.asp (a1e11042-a74a-46e6-b07c-c4ce8ecc239b)
Detects potential registry persistence technique using the Event Viewer "Events.asp" technique
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) | Attack Pattern | Potential Persistence Via Event Viewer Events.asp (a1e11042-a74a-46e6-b07c-c4ce8ecc239b) | Sigma-Rules | 1 |