Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Important Windows Eventlog Cleared

Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)Created Tue May 17Updated Wed Nov 15100ef69e-3327-481c-8e5c-6d80d9507556windows
Log Source
Windowssystem
ProductWindows← raw: windows
Servicesystem← raw: system
Detection Logic
Detection Logic1 selector
detection:
    selection:
        EventID: 104
        Provider_Name: 'Microsoft-Windows-Eventlog'
        Channel:
            - 'Microsoft-Windows-PowerShell/Operational'
            - 'Microsoft-Windows-Sysmon/Operational'
            - 'PowerShellCore/Operational'
            - 'Security'
            - 'System'
            - 'Windows PowerShell'
    condition: selection
False Positives

Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)

System provisioning (system reset before the golden image creation)

References
1
Resolving title…
twitter.com
2
Resolving title…
hybrid-analysis.com
MITRE ATT&CK

CAR Analytics

2016-04-002 · CAR 2016-04-002
Related Rules
DerivedDetectionmedium

Eventlog Cleared

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
100ef69e-3327-481c-8e5c-6d80d9507556
Status
test
Level
high
Type
Detection
Created
Tue May 17
Modified
Wed Nov 15
Author
Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
Path
rules/windows/builtin/system/microsoft_windows_eventlog/win_system_susp_eventlog_cleared.yml
Raw Tags
attack.defense-evasionattack.t1070.001car.2016-04-002
View on GitHub