access-the-windows-event-log.yml

rule:
  meta:
    name: access the Windows event log
    namespace: host-interaction/log/winevt/access
    author: moritz.raabe@fireeye.com
    scope: function
  features:
    - or:
      - api: OpenEventLog
      - api: ClearEventLog
      - api: OpenBackupEventLog
      - api: ReportEvent