Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
135 detections
Filters
Last updated
All Time
Detection languages
47
36
18
10
8
Contributors
41
27
11
11
11
Categories
103
67
64
25
16
Platforms
134
3
1
1
Products / Services
86
64
34
30
19
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
2
1
IDS Protocols
3
Detects the clearing of Windows event logs using the native 'wevtutil.exe' utility. This behavior is a common indicator of anti-forensics activity where attackers attempt to remove evidence of their presence or actions on a compromised host.
Detects attempts to clear Windows Event Logs using either the built-in 'wevtutil.exe' utility or the PowerShell 'Clear-EventLog' cmdlet. Attackers often clear these logs to remove evidence of intrusion activities, such as persistence mechanisms, account creation, or privilege escalation.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility with the 'cl' command, the PowerShell 'Clear-EventLog' cmdlet, or by identifying specific system events (EventID 1102 and 104) that signify the security or system logs have been cleared.
Detects the execution of 'wevtutil.exe' with the 'cl' or 'clear-log' arguments targeted at primary Windows Event Logs (Security, System, or Application). This activity is commonly associated with an adversary attempting to clear audit logs to conceal malicious actions during an intrusion.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
Detects the use of the Windows command-line utility 'wevtutil.exe' to clear Windows event logs. Attackers often clear logs to hide evidence of post-compromise activity.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or the PowerShell 'Clear-EventLog' command. This behavior is often associated with adversaries attempting to remove evidence of their actions from a compromised system.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or the PowerShell 'Clear-EventLog' command. This behavior is often associated with adversaries attempting to remove evidence of their actions from a compromised system.
Detects attempts to clear Windows event logs using the built-in 'wevtutil.exe' utility or PowerShell cmdlets 'Clear-EventLog'. Adversaries often perform this action to remove evidence of malicious activity from the host.
Detects attempts to stop or clear Windows Event Logs using command-line utilities such as 'sc', 'net', or 'wevtutil'. This activity is often performed by adversaries to remove forensic evidence of their actions.
Detects the post-encryption cleanup routine where Nightspire utilizes wevtutil to clear Security, System, and Application event logs to hinder incident response efforts. This rule specifically looks for the execution of 'wevtutil.exe' with the 'cl' (clear log) command targeting 'System', 'Security', or 'Application' event logs, and correlates it with the presence of files ending with '.nightspire' on the same device.
Detects attempts to clear Windows event logs using built-in utilities including wevtutil.exe, PowerShell, or through direct event log event ID triggers (1102, 104). This activity is often associated with adversaries attempting to remove evidence of their presence on a system.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or PowerShell cmdlets. Attackers often clear logs to remove evidence of their malicious activities after achieving persistence or executing other operations.
Detects attempts to clear Windows event logs using the wevtutil.exe command-line utility or by triggering native Windows Event Log IDs 1102 (Security log cleared) or 104 (System log cleared). Clearing these logs is a common technique used by adversaries to hide indicators of malicious activity following an intrusion.
Detects the execution of anti-forensic techniques often associated with the Payouts King ransomware campaign. The rule monitors for the deletion of volume shadow copies via vssadmin, the clearing of Windows event logs using wevtutil, and the clearing of the recycle bin. The correlation of these events suggests an attempt to inhibit system recovery and remove indicators of compromise.
Detects command-line clearing of security, system, application, or PowerShell event logs to impede investigation. This rule specifically looks for the use of 'wevtutil.exe', 'powershell.exe', or 'cmd.exe' with command-line arguments indicative of clearing event logs, such as 'wevtutil.*(cl|clear-log)', 'Clear-EventLog', or 'Remove-EventLog'.
Correlates the EDR kill sequence with the attacker utilizing wevtutil to clear the Security and System event logs to cover their tracks. This rule detects the execution of 'wevtutil.exe' with the 'cl' (clear log) command targeting 'System' or 'Security' event logs, joined with the creation of a '.sys' file, which could indicate a Bring Your Own Vulnerable Driver (BYOVD) attack attempting to disable EDR and clear logs.
Detects attempts to clear Windows Event Logs using either the wevtutil command-line utility, PowerShell Clear-EventLog cmdlets, or by monitoring specific Windows Security Event IDs 1102 and 104 which indicate logs have been cleared.
Detects attempts to clear Windows event logs using the wevtutil command-line utility or PowerShell cmdlets (Clear-EventLog, Remove-EventLog). Adversaries often clear event logs to hinder forensic investigations and remove evidence of their malicious activity.
This rule detects when the Windows Security Event Log (Event ID 1102) or the System Event Log (Event ID 104) has been cleared. Clearing event logs is a common tactic used by adversaries to remove evidence of their activities on a compromised system.
Page 3 of 7