Detectionmediumtest
Suspicious Use of PsLogList
Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Sat Dec 18Updated Tue Mar 05aae1243f-d8af-40d8-ab20-33fc6d0c55bcwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic3 selectors
detection:
selection_img:
- OriginalFileName: 'psloglist.exe'
- Image|endswith:
- '\psloglist.exe'
- '\psloglist64.exe'
selection_cli_eventlog:
CommandLine|contains:
- ' security'
- ' application'
- ' system'
selection_cli_flags:
CommandLine|contains|windash:
- ' -d'
- ' -x'
- ' -s'
- ' -c' # Clear event log after displaying
- ' -g' # Export an event log as an evt file.
condition: all of selection_*False Positives
Another tool that uses the command line switches of PsLogList
Legitimate use of PsLogList by an administrator
MITRE ATT&CK
Tactics
Techniques
Sub-techniques
Rule Metadata
Rule ID
aae1243f-d8af-40d8-ab20-33fc6d0c55bc
Status
test
Level
medium
Type
Detection
Created
Sat Dec 18
Modified
Tue Mar 05
Path
rules/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml
Raw Tags
attack.discoveryattack.t1087attack.t1087.001attack.t1087.002