Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Eventlog Cleared

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems)Created Tue Jan 10Updated Wed Nov 15a62b37e0-45d3-48d9-a517-90c1a1b0186bwindows
Log Source
Windowssystem
ProductWindows← raw: windows
Servicesystem← raw: system
Detection Logic
Detection Logic2 selectors
detection:
    selection:
        EventID: 104
        Provider_Name: 'Microsoft-Windows-Eventlog'
    filter_main_covered:
        # The channels below are already covered by the rule 100ef69e-3327-481c-8e5c-6d80d9507556
        Channel:
            - 'Microsoft-Windows-PowerShell/Operational'
            - 'Microsoft-Windows-Sysmon/Operational'
            - 'PowerShellCore/Operational'
            - 'Security'
            - 'System'
            - 'Windows PowerShell'
    condition: selection and not 1 of filter_main_*
False Positives

Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)

System provisioning (system reset before the golden image creation)

References
1
Resolving title…
twitter.com
2
Resolving title…
hybrid-analysis.com
MITRE ATT&CK

CAR Analytics

2016-04-002 · CAR 2016-04-002
Related Rules
Similar

f2f01843-e7b8-4f95-a35a-d23584476423

Rule not found
DerivedDetectionhigh

Security Eventlog Cleared

One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

This rule was derived from the related rule - both detect similar activity with different scope.

DerivedDetectionhigh

Important Windows Eventlog Cleared

Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
a62b37e0-45d3-48d9-a517-90c1a1b0186b
Status
test
Level
medium
Type
Detection
Created
Tue Jan 10
Modified
Wed Nov 15
Author
Florian Roth (Nextron Systems)
Path
rules/windows/builtin/system/microsoft_windows_eventlog/win_system_eventlog_cleared.yml
Raw Tags
attack.defense-evasionattack.t1070.001car.2016-04-002
View on GitHub