Back to list

Medium CINC-20251221-A8878241 new

Aggregate ID: aggind:024efd237c2d4f87958607652cb04c8b:17314859155

Incident ID CINC-20251221-A8878241

Severity Medium (70)

Status new

Alert Count 6

Host Count 1

First Seen 2025-12-22 00:57:17

Last Seen 2025-12-22 00:58:17

Duration 0d 0h 1m

Created 2025-12-22 08:36

Updated 2026-01-13 15:14

Rec... Ini... Exe... Per... Pri... Def... Cre... Dis... Lat... Col... Com... Exf... Imp...

Observed Tactics:

Techniques:

Severity	Status	Hostname	Description	Tactic	Command Line	Time
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl Security	12-22 00:58
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl Security	12-22 00:57
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl Security	12-22 00:57
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl Security	12-22 00:57
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl Security	12-22 00:57
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl Security	12-22 00:57