Detection rules › By event

Microsoft-Windows-Kernel-General

Event	Rules
Event ID 16	1

Event ID 16

1 detection rules reference this event. View event page.

Sigma (1)

Critical Hive In Suspicious Location Access Bits Cleared severity high T1003, T1003.002