Query: write Sigma for Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".
Matching passage: Sigma rule: Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".. Logsource: windows / process_creation. Rule: title: Suspicious Eventlog Clearing or Configuration Change Activity id: cc36992a-4671-4f21-a91d-6c2b72a2edf5 status: stable description: 'Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee - https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/ - https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7 - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_ - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2019-09-26 modified: 2026-06-01 tags: - attack.defense-impairment - attack.t1685.005 - attack.t1685.001 - car.2016-04-002 logsource: category: process_creation product: windows detection: selection_wevtutil_img: - Image|endswith: \wevtutil.exe - OriginalFileName: wevtutil.exe selection_wevtutil_cmd: CommandLine|contains: - 'clear-log ' - ' cl ' - 'set-log ' - ' sl ' - 'lfn:' selection_other_ps_img: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe selection_other_ps_cmd: - CommandLine|contains: - 'Clear-EventLog ' - 'Remove-EventLog ' - 'Limit-EventLog ' - 'Clear-WinEvent ' - CommandLine|contains|all: - Eventing.Reader.EventLogSession - ClearLog - CommandLine|contains|all: - Diagnostics.EventLog - Clear selection_other_wmi: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \wmic.exe CommandLine|contains: ClearEventLog filter_main_msiexec: ParentImage: - C:\Windows\SysWOW
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or M. Logsource: m365 / threat_management. Rule: title: Suspicious OAuth App File Download Activities id: ee111937-1fe7-40f0-962a-0eb44d57d174 status: test description: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.exfiltration logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Suspicious OAuth app file download activities status: success condition: selection falsepositives: - Unknown level: medium