Suspicious Win32_NTEventlogFile WMI Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects the use of the WMI class "Win32_NTEventlogFile" with methods that can be used to manipulate event logs, such as deleting, backing up, or changing permissions. This activity, especially when originating from a PowerShell script, can be indicative of an adversary attempting to evade detection or inhibit system recovery.