Query: detection rule: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution
Matching passage: Sigma rule: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution. Logsource: windows / system. Rule: title: Important Windows Eventlog Cleared id: 100ef69e-3327-481c-8e5c-6d80d9507556 related: - id: a62b37e0-45d3-48d9-a517-90c1a1b0186b type: derived status: test description: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution references: - https://twitter.com/deviouspolack/status/832535435960209408 - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2022-05-17 modified: 2023-11-15 tags: - attack.defense-impairment - attack.t1685.005 - car.2016-04-002 logsource: product: windows service: system detection: selection: EventID: 104 Provider_Name: Microsoft-Windows-Eventlog Channel: - Microsoft-Windows-PowerShell/Operational - Microsoft-Windows-Sysmon/Operational - PowerShellCore/Operational - Security - System - Windows PowerShell condition: selection falsepositives: - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog) - System provisioning (system reset before the golden image creation) level: high
Near-miss passage: Sigma rule: Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario w. Logsource: windows / security. Rule: title: Windows Event Auditing Disabled id: 69aeb277-f15f-4d2d-b32a-55e883609563 related: - id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1 type: derived status: test description: 'Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. Also, it is recommended to turn off "Local Group Policy Object Processing" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as "gpedit.msc". Please note, that disabling "Local Group Policy Object Processing" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways. ' references: - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit author: '@neu5ron, Nasreddine Bencherchali (Nextron Systems)' date: 2017-11-19 modified: 2023-11-15 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows service: security definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64 detection: selection: EventID: 4719 AuditPolicyChanges|contains: - '%%8448' - '%%8450' filter_main_guid: SubcategoryGuid: - '{0CCE9210-69AE-11D9-BED3-505054503030}' - '{0CCE9211-69AE-11D9-BED3-505054503030}' - '{0CCE9212-69AE-11D9-BED3-505054503030}' - '{0CCE9215-69AE-11D9-BED3-505054503030}' - '{0CCE9217-69AE-11D9-BED3-505054503030}' - '{0CCE921B-69AE-11D9-BED3-505054503030}' - '{0CCE922B-69AE-11D9-BED3-505054503030}' - '{0CCE922F-69AE-11D9-BED3-505054503030}' - '{0CCE9230-69AE-11D9-BED3-505054503030}' - '{0CCE9235-69AE-11D9-BED3-505054503030}' - '{0CCE9236-69AE-11D9-BED3-505054503030}' - '{0CCE9237-69AE-11D9-BED3-505054503030}' - '{0CCE923F-69AE-11D9-BED3-505054503030}' - '{0CCE9240-69AE-11D9-BED3-505054503030}' - '{0CCE9242-69AE-11D9-BED3-505054503030}' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: low