attack.t1685.001 — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• Audit Policy Tampering Via Auditpol · sigma-rule
• Audit Policy Tampering Via NT Resource Kit Auditpol · sigma-rule
• Change Winevt Channel Access Permission Via Registry · sigma-rule
• Disable Security Events Logging Adding Reg Key MiniNt · sigma-rule
• Disable Windows Event Logging Via Registry · sigma-rule
• Disable Windows IIS HTTP Logging · sigma-rule
• ETW Logging/Processing Option Disabled On IIS Server · sigma-rule
• EVTX Created In Uncommon Location · sigma-rule
• Filter Driver Unloaded Via Fltmc.EXE · sigma-rule
• HackTool - SharpEvtMute DLL Load · sigma-rule
• HackTool - SharpEvtMute Execution · sigma-rule
• HackTool - SysmonEnte Execution · sigma-rule
• HTTP Logging Disabled On IIS Server · sigma-rule
• Important Windows Event Auditing Disabled · sigma-rule
• New Module Module Added To IIS Server · sigma-rule
• Potential AutoLogger Sessions Tampering · sigma-rule
• Potential EventLog File Location Tampering · sigma-rule
• Potential Suspicious Activity Using SeCEdit · sigma-rule
• Previously Installed IIS Module Was Removed · sigma-rule
• Security Event Logging Disabled via MiniNt Registry Key - Process · sigma-rule
• Security Event Logging Disabled via MiniNt Registry Key - Registry Set · sigma-rule
• Suspicious Eventlog Clearing or Configuration Change Activity · sigma-rule
• Suspicious Svchost Process Access · sigma-rule
• Sysmon Driver Unloaded Via Fltmc.EXE · sigma-rule
• Windows Event Auditing Disabled · sigma-rule
• Windows EventLog Autologger Session Registry Modification Via CommandLine · sigma-rule