Skip to content

Hide Navigation Hide TOC

HackTool - SharpEvtMute DLL Load (49329257-089d-46e6-af37-4afce4290685)

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

Cluster A Galaxy A Cluster B Galaxy B Level
Disable Windows Event Logging - T1562.002 (4eb28bed-d11a-4641-9863-c2ac017d910a) Attack Pattern HackTool - SharpEvtMute DLL Load (49329257-089d-46e6-af37-4afce4290685) Sigma-Rules 1
Disable Windows Event Logging - T1562.002 (4eb28bed-d11a-4641-9863-c2ac017d910a) Attack Pattern Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern 2