Smartcard Disabled Event Detected

Collin Lairamore@Bollinmore

•updated May 5, 2026•3•0•205

This rule detects when a smartcard is disabled, indicated by a specific change code (2060) in Windows raw event data. Disabling smartcards can be a tactic used by adversaries to bypass multi-factor authentication or other security controls.