Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
83
43
25
23
19
Contributors
96
33
16
13
11
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
169
35
14
10
8
Products / Services
126
95
56
41
29
MITRE Techniques
159
103
49
31
30
CVEs
1
1
1
1
1
IDS Classtypes
5
2
IDS Protocols
7
Detects the use of the WMI class "Win32_NTEventlogFile" within a PowerShell script to perform suspicious actions such as deleting, backing up, changing permissions, renaming, or taking ownership of event logs. This activity is often associated with defense evasion tactics by adversaries attempting to remove forensic evidence or impair system defenses.
Detects the use of the WMI class "Win32_NTEventlogFile" with methods that can be used to manipulate event logs, such as deleting, backing up, or changing permissions. This activity, especially when originating from a PowerShell script, can be indicative of an adversary attempting to evade detection or inhibit system recovery.
Page 12 of 12