HackTool - SharpEvtMute Execution

Title: HackTool - SharpEvtMute Execution
Status: test
Description:Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs
References:
  -https://github.com/bats3c/EvtMute
Author: Florian Roth (Nextron Systems)
Date: 2022-09-07
modified:2023-02-14
Tags:

• -'attack.defense-impairment'
• -'attack.t1685.001'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
Image|endswith:'\SharpEvtMute.exe' Description:'SharpEvtMute'     - CommandLine|contains:
      - '--Filter "rule '
      - '--Encoded --Filter \"'
  condition:selection
Falsepositives:
  -Unknown
Level: high