Detectionmediumtest

Suspicious Eventlog Clear

Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)Created Mon Sep 12Updated Mon Oct 060f017df3-8f5a-414f-ad6b-24aff1128278windows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection:
        - ScriptBlockText|contains:
              - 'Clear-EventLog '
              - 'Remove-EventLog '
              - 'Limit-EventLog '
              - 'Clear-WinEvent '
        - ScriptBlockText|contains|all:
              - 'Eventing.Reader.EventLogSession' # [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($_.LogName)
              - 'ClearLog'
        - ScriptBlockText|contains|all:
              - 'Diagnostics.EventLog'
              - 'Clear'
    condition: selection

False Positives

Rare need to clear logs before doing something. Sometimes used by installers or cleaner scripts. The script should be investigated to determine if it's legitimate

References

eqllib.readthedocs.io

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Sub-techniques

T1070.001 · Clear Windows Event Logs

Related Rules

DerivedDetectionhigh

Suspicious Eventlog Clearing or Configuration Change Activity

Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

0f017df3-8f5a-414f-ad6b-24aff1128278

Status

test

Level

medium

Type

Detection

Created

Mon Sep 12

Modified

Mon Oct 06

Author

Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)

Path

rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml

Raw Tags

attack.defense-evasionattack.t1070.001

View on GitHub