Suppresses Windows Event Log collection by identifying and terminating the EventLog service threads within svchost.exe, using either the service tag or the thread's association with wevtsvc.dll. The svchost.exe process may remain present while the EventLog service stops processing events.
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
IEX · Execute a Local Script Path
Execute a Local Script Path
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.Shell: RESTRICTED_ACCESS_BLUR_MARKER. Privileges: not documented.preconditions: RESTRICTED_ACCESS_BLUR_MARKERdependencies: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKER