Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
232 detections
Filters
Last updated
All Time
Detection languages
82
43
25
23
19
Contributors
96
33
16
13
11
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
168
34
14
10
8
Products / Services
126
95
56
41
29
MITRE Techniques
159
103
48
31
30
CVEs
1
1
1
1
1
IDS Classtypes
5
2
IDS Protocols
7
Detects usage of wevtutil to clear Security or System event logs
as observed in The Gentlemen ransomware operations for defense evasion and
covering tracks of their malicious activities.
as observed in The Gentlemen ransomware operations for defense evasion and
covering tracks of their malicious activities.
The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments.
This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments.
This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs.
Clearing the event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
Clearing the event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
The following analytic detects the clearing of Windows event logs by identifying Windows Security Event ID 1102 or System log event 104. This detection leverages Windows event logs to monitor for log clearing activities. Such behavior is significant as it may indicate an attempt to cover tracks after malicious activities. If confirmed malicious, this action could hinder forensic investigations and allow attackers to persist undetected, making it crucial to investigate further and correlate with other alerts and data sources.
The following analytic detects the shutdown of the Windows Event Log service by leveraging Windows Event ID 1100. This event is logged every time the service stops, including during normal system shutdowns. Monitoring this activity is crucial as it can indicate attempts to cover tracks or disable logging. If confirmed malicious, an attacker could hide their activities, making it difficult to trace their actions and investigate further incidents. Analysts should verify if the shutdown was planned and review other alerts and data sources for additional suspicious behavior.
Detects command-line activity on a NetScaler appliance indicative of defense evasion by truncating, deleting, or disabling audit logs (ns.log) and syslog forwarding services. This activity often follows the exploitation of public-facing application vulnerabilities where an attacker seeks to hide their presence.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
Detects attempts to clear Windows event logs using built-in utilities like wevtutil.exe, PowerShell commands (Clear-EventLog, Remove-EventLog), or the detection of Event ID 1102 (Log cleared). This activity is commonly used by adversaries, including ransomware affiliates, to obfuscate their tracks during or after an attack.
Detects the clearing of the Windows Security event log, which generates Event ID 1102. This action is often performed by adversaries to cover their tracks after performing malicious activities on a compromised host.
Detects attempts by a principal to modify, stop, or delete AWS CloudTrail logging configurations. Such activity is a common indicator of defense evasion during the early stages of a cloud-based attack to prevent audit trail capture.
Detects unauthorized attempts to delete or purge critical Salesforce audit logs, including the Setup Audit Trail, Login History, and Event Monitoring log files. This behavior is indicative of anti-forensic activity, often utilized by threat actors such as ShinyHunters to destroy audit evidence following unauthorized access, data export, or credential manipulation.
This rule detects potential anti-forensic activity on Citrix ADC/NetScaler devices by monitoring for two primary indicators of log tampering: an unexpected drop in syslog volume to zero following a period of activity, or the execution of explicit commands intended to clear audit logs and configuration files.
Detects unauthorized or suspicious modifications to audit and logging configurations across AWS, Azure, and GCP. The rule identifies actions such as stopping, deleting, or updating logging trails, diagnostic settings, or logging sinks, which may indicate an adversary attempting to impair visibility into their activities (Anti-Forensics).
Detects unauthorized modifications or deletions of cloud logging sinks in Google Cloud Platform (GCP) or diagnostic settings in Azure, which may indicate an attacker attempting to disable audit logs to cover their tracks or evade detection.
Detects unauthorized mass clearing of Windows Event Logs using wevtutil or PowerShell cmdlets. This behavior is often observed in ransomware campaigns (e.g., Nova, Gentlemen) as an anti-forensic measure to hinder incident response and investigation by removing audit trails across significant log channels like Security, System, and PowerShell.
Detects execution of common Windows utilities used by adversaries post-encryption to hinder system recovery and clear forensic evidence. This includes disabling the Windows Recovery Environment (ReAgentC), wiping disk free space (Cipher), clearing DNS caches, and clearing Windows Event Logs via Wevtutil or PowerShell.
Detects attempts to clear or delete Windows Event Logs using common utilities like wevtutil.exe, PowerShell cmdlets, or direct file system deletion of .evtx files.
Detects the clearing of Windows Event Logs via wevtutil, PowerShell, or registry modification, occurring within one hour of a remote interactive or network logon event on the same host. This pattern is indicative of anti-forensic activity often performed following lateral movement or prior to destructive actions like ransomware deployment.
Detects attempts to disable security services (Windows Defender, EDR agents), modify audit policies via auditpol, or stop/clear the Windows Event Log service. This behavior is a common precursor to post-compromise activity intended to blind defenders and conceal malicious actions.
Detects Windows Security (1102) or System (104) log clearing events that occur within 30 minutes of privileged activity (new account creation, group membership changes, or service installation) on the same host, sharply reducing false positives versus alerting on log clears alone.
Detects Windows Security (1102) or System (104) log clearing events that occur within 30 minutes of privileged activity (new account creation, group membership changes, or service installation) on the same host, sharply reducing false positives versus alerting on log clears alone.
Page 1 of 12