Title:HackTool - SharpEvtMute DLL Load Status:test Description:Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs References: -https://github.com/bats3c/EvtMute Author: Florian Roth (Nextron Systems) Date: 2022-09-07 modified:2024-11-23 Tags:
-'attack.defense-impairment'
-'attack.t1685.001'
Logsource:
category: image_load
product: windows
Detection: selection: Hashes|contains:
'IMPHASH=330768A4F172E10ACB6287B87289D83B' condition:selection Falsepositives:
-Other DLLs with the same Imphash Level:high
