Event Forwarding Subscription Tampering

Adversaries may alter logging tools or pipelines to reduce, redirect, or manipulate telemetry available to defenders. One Windows example is unauthorized modification of Windows Event Forwarding subscriptions or source Subscription Manager configuration. WEF is a legitimate centralized logging feature; this entry focuses on authorized, read-only review of its current configuration and health.