Back to list

Medium CINC-20251221-BA10C1F2 new

Aggregate ID: aggind:024efd237c2d4f87958607652cb04c8b:17470348566

Incident ID CINC-20251221-BA10C1F2

Severity Medium (70)

Status new

Alert Count 6

Host Count 1

First Seen 2025-12-22 05:02:24

Last Seen 2025-12-22 05:03:24

Duration 0d 0h 1m

Created 2025-12-22 08:36

Updated 2026-01-13 15:14

Rec... Ini... Exe... Per... Pri... Def... Cre... Dis... Lat... Col... Com... Exf... Imp...

Observed Tactics:

Techniques:

Severity	Status	Hostname	Description	Tactic	Command Line	Time
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-22 05:03
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-22 05:02
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-22 05:02
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-22 05:02
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-22 05:02
High	new	BOOK-R0BE6S1NC3	A process removed or cleared Windows Event Logs. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Investigate the process tree.	Defense Evasion	"wevtutil.exe" cl System	12-22 05:02