Query: alert when Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".
Matching passage: Sigma rule: Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".. Logsource: windows / process_creation. Rule: title: Suspicious Eventlog Clearing or Configuration Change Activity id: cc36992a-4671-4f21-a91d-6c2b72a2edf5 status: stable description: 'Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee - https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/ - https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7 - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_ - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2019-09-26 modified: 2026-06-01 tags: - attack.defense-impairment - attack.t1685.005 - attack.t1685.001 - car.2016-04-002 logsource: category: process_creation product: windows detection: selection_wevtutil_img: - Image|endswith: \wevtutil.exe - OriginalFileName: wevtutil.exe selection_wevtutil_cmd: CommandLine|contains: - 'clear-log ' - ' cl ' - 'set-log ' - ' sl ' - 'lfn:' selection_other_ps_img: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe selection_other_ps_cmd: - CommandLine|contains: - 'Clear-EventLog ' - 'Remove-EventLog ' - 'Limit-EventLog ' - 'Clear-WinEvent ' - CommandLine|contains|all: - Eventing.Reader.EventLogSession - ClearLog - CommandLine|contains|all: - Diagnostics.EventLog - Clear selection_other_wmi: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \wmic.exe CommandLine|contains: ClearEventLog filter_main_msiexec: ParentImage: - C:\Windows\SysWOW
Near-miss passage: Sigma rule: Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintex. Logsource: windows / registry_event. Rule: title: Security Support Provider (SSP) Added to LSA Configuration id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc status: test description: 'Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows. ' references: - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/ - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157 author: iwillkeepwatch date: 2019-01-18 modified: 2026-03-30 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.005 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: - \Control\Lsa\Security Packages - \Control\Lsa\OSConfig\Security Packages filter_main_msiexec: Image: - C:\Windows\system32\msiexec.exe - C:\Windows\syswow64\MsiExec.exe filter_main_image_null: Image: null condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high