Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
83
43
25
23
19
Contributors
96
33
16
13
11
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
169
35
14
10
8
Products / Services
126
95
56
41
29
MITRE Techniques
159
103
49
31
30
CVEs
1
1
1
1
1
IDS Classtypes
5
2
IDS Protocols
7
Detects the frequent clearing of specific Windows Event Logs using the built-in wevtutil.exe utility. Attackers often clear logs to hide evidence of post-exploitation activity such as credential access, lateral movement, or persistence installation.
Detects the execution of the Windows Event Utility (wevtutil.exe) with the 'cl' (clear-log) command, specifically targeting multiple critical event logs simultaneously. This behavior is indicative of anti-forensic activity aimed at obfuscating post-compromise actions, as seen in the Settra ransomware campaign.
Detects the use of the 'wevtutil.exe' command to clear Windows Event Logs where the command specifies a misspelled event log name, 'Microsoft-Windows-Defender/Operational' instead of the correct 'Microsoft-Windows-Windows-Defender/Operational'. This specific spelling error is associated with the Settra ransomware and indicates an unsuccessful attempt to clear Windows Defender logs.
Detects the suspicious sequential execution of the 'wevtutil cl' command to clear multiple critical Windows Event Log channels, including security, system, and application logs. This behavior is indicative of anti-forensic activities performed by adversaries, such as the Settra ransomware, to hinder incident response and forensic analysis.
Detects the use of the wevtutil.exe utility to clear specific Windows Event Logs. Adversaries may clear event logs to hide evidence of malicious activity on a system.
Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.
Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.
Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.
Detects the clearing of Windows event logs using the native 'wevtutil.exe' command or the PowerShell 'Clear-EventLog' cmdlet. This activity is commonly associated with anti-forensic techniques used by threat actors and wiper malware to obstruct incident response efforts and remove traces of malicious activity.
Detects efforts to clear Windows Event Logs using PowerShell (Clear-EventLog, EventLogSession.ClearLog) or wevtutil.exe (cl, clear-log). This behavior is characteristic of anti-forensic activities performed by ransomware like Nova to impede incident response and investigation efforts.
Detects evidence of log clearing or tampering activity associated with the GigaWiper destructive backdoor, specifically monitoring for the use of wevtutil to clear event logs, the manual deletion of the Security.evtx log file, or the presence of a specific marker string often utilized by this threat.
Detects evidence of log clearing or tampering activity associated with the GigaWiper destructive backdoor, specifically monitoring for the use of wevtutil to clear event logs, the manual deletion of the Security.evtx log file, or the presence of a specific marker string often utilized by this threat.
Detects evidence of log clearing or tampering activity associated with the GigaWiper destructive backdoor, specifically monitoring for the use of wevtutil to clear event logs, the manual deletion of the Security.evtx log file, or the presence of a specific marker string often utilized by this threat.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects attempts to clear Windows event logs using the wevtutil utility (clearing Security, System, or Application logs) or the native Windows event log clearing event ID 1102 (The audit log was cleared).
Detects the clearing of Windows Security or System event logs using either the 'wevtutil' command-line utility or the 'Clear-EventLog' PowerShell cmdlet. This activity is commonly associated with anti-forensic efforts by adversaries to remove evidence of malicious actions, such as credential harvesting, following a compromise.
This rule detects attempts to clear Windows event logs using either the 'wevtutil.exe' command-line utility or the 'Clear-EventLog' PowerShell cmdlet. Adversaries often clear event logs to hide evidence of their activity on a compromised host.
Detects attempts to clear Windows Event Logs using either the command-line utility 'wevtutil.exe' or the PowerShell cmdlet 'Clear-EventLog'. Additionally, it monitors for Windows Security Event ID 1102, which specifically indicates the clearing of the Security log. These actions are common indicators of an adversary attempting to remove evidence of their activity from a host system.
Detects attempts by malicious processes, specifically those associated with Millennium RAT or launching from suspicious user-writable directories (AppData, Temp, etc.), to disable or tamper with security controls. This includes modifying Windows Defender configurations, stopping security services, clearing event logs, modifying audit policies, and terminating security-related processes.
Detects malicious attempts to clear Windows Event Logs using native utilities like wevtutil or PowerShell, or by direct file deletion of .evtx files. This behavior is common in post-exploitation cleanup phases by threat actors, such as The Gentlemen RaaS, to hinder incident response and forensic analysis.
Page 4 of 12