Query: rule covering Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".
Matching passage: Sigma rule: Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".. Logsource: windows / process_creation. Rule: title: Suspicious Eventlog Clearing or Configuration Change Activity id: cc36992a-4671-4f21-a91d-6c2b72a2edf5 status: stable description: 'Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee - https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/ - https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7 - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_ - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2019-09-26 modified: 2026-06-01 tags: - attack.defense-impairment - attack.t1685.005 - attack.t1685.001 - car.2016-04-002 logsource: category: process_creation product: windows detection: selection_wevtutil_img: - Image|endswith: \wevtutil.exe - OriginalFileName: wevtutil.exe selection_wevtutil_cmd: CommandLine|contains: - 'clear-log ' - ' cl ' - 'set-log ' - ' sl ' - 'lfn:' selection_other_ps_img: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe selection_other_ps_cmd: - CommandLine|contains: - 'Clear-EventLog ' - 'Remove-EventLog ' - 'Limit-EventLog ' - 'Clear-WinEvent ' - CommandLine|contains|all: - Eventing.Reader.EventLogSession - ClearLog - CommandLine|contains|all: - Diagnostics.EventLog - Clear selection_other_wmi: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \wmic.exe CommandLine|contains: ClearEventLog filter_main_msiexec: ParentImage: - C:\Windows\SysWOW
Near-miss passage: Sigma rule: Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execut. Logsource: windows / process_creation. Rule: title: Use of FSharp Interpreters id: b96b2031-7c17-4473-afe7-a30ce714db29 status: test description: 'Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline. ' references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac - https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/ author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-02 modified: 2024-04-23 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \fsi.exe - \fsianycpu.exe - OriginalFileName: - fsi.exe - fsianycpu.exe condition: selection falsepositives: - Legitimate use by a software developer. level: medium