Back to list

Medium CINC-20251220-01CF0E43 new

Aggregate ID: aggind:024efd237c2d4f87958607652cb04c8b:17250403166

Incident ID CINC-20251220-01CF0E43

Severity Medium (70)

Status new

Alert Count 6

Host Count 1

First Seen 2025-12-20 08:49:16

Last Seen 2025-12-20 08:50:16

Duration 0d 0h 1m

Created 2025-12-20 13:23

Updated 2026-01-13 15:14

Rec... Ini... Exe... Per... Pri... Def... Cre... Dis... Lat... Col... Com... Exf... Imp...

Observed Tactics:

Techniques:

Severity	Status	Hostname	Description	Tactic	Command Line	Time
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-20 08:50
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-20 08:49
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-20 08:49
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-20 08:49
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-20 08:49
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-20 08:49