I recently TA’d the SANS SEC 504 class (Hacker Tools, Techniques, Exploits, and Incident Handling) , and one of the topics we covered was attackers “editing” windows event logs to cover their tracks, especially the Windows Security Event Log.
Article Link: https://isc.sans.edu/diary/rss/25328