Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
135 detections
Filters
Last updated
All Time
Detection languages
47
36
18
10
8
Contributors
41
27
11
11
11
Categories
103
67
64
25
16
Platforms
134
3
1
1
Products / Services
86
64
34
30
19
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
2
1
IDS Protocols
3
This rule detects when the Windows Security Event Log (Event ID 1102) or the System Event Log (Event ID 104) has been cleared. Clearing event logs is a common tactic used by adversaries to remove evidence of their activities on a compromised system.
Detects the clearing of multiple Windows Event Logs using the built-in 'wevtutil.exe' utility. This behavior is often associated with adversaries attempting to remove evidence of their presence or activities by clearing system, security, or application event logs.
Detects the execution of 'wevtutil.exe' with the 'cl' or 'clear-log' arguments targeted at primary Windows Event Logs (Security, System, or Application). This activity is commonly associated with an adversary attempting to clear audit logs to conceal malicious actions during an intrusion.
Detects the use of the Windows command-line utility 'wevtutil.exe' to clear Windows event logs. Attackers often clear logs to hide evidence of post-compromise activity.
Detects the clearing of Windows Security and System event logs, or Defender XDR audit logs, indicating potential adversary activity to remove traces of their actions.
Detects instances where Windows event logs are cleared using built-in utilities (wevtutil.exe) or PowerShell (Get-EventLog/Get-WinEvent, Clear-EventLog) shortly after those same logs were queried or enumerated by the same user on the same device. This pattern is highly indicative of an adversary attempting to conceal malicious activity.
Detects disabling of Windows Event Log service
Detects Kazuar clearing specific Security logs via the ClearEventLog Windows API immediately after lateral movement. The rule specifically looks for 'ClearEventLogApiCall' actions and excludes common legitimate tools like 'wevtutil.exe' and 'powershell.exe' that might perform similar actions.
Detects the specific defense evasion tactic where malware invokes wevtutil to clear event logs immediately after executing its payload, effectively taunting defenders. This rule specifically looks for 'wevtutil.exe' being executed with the 'cl' (clear log) command-line argument, and filters out common legitimate processes like cmd.exe, powershell.exe, and explorer.exe as initiating processes.
This rule detects when Windows Security or System event logs are cleared. Adversaries often clear event logs to remove evidence of their activities after gaining access to a system.
This rule detects when the Windows Security Event Log (Event ID 1102) has been cleared on a system. Clearing event logs is a common technique used by adversaries to remove traces of their activity and evade detection.
This rule detects when the Windows Security Event Log (Event ID 1102) has been cleared on a system. Clearing event logs is a common technique used by adversaries to remove traces of their activity and evade detection.
This rule detects attempts to remotely clear event logs over Server Message Block (SMB) by looking for the strings "Eventlog" and "ClearEventLog" in TCP traffic destined for port 445. This activity is often associated with adversaries attempting to remove forensic evidence of their presence on a system.
Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".
This technique were seen used by threat actors and ransomware strains in order to evade defenses.
This technique were seen used by threat actors and ransomware strains in order to evade defenses.
Detects the clearing of Windows event logs using command line tools like wevtutil or PowerShell. This is a standard example rule.
Detects the usage of 'wevtutil.exe' to clear critical Windows event logs (Application, Security, System, Windows PowerShell). This activity is often associated with defense evasion tactics used by adversaries, including ransomware like VECT, to remove forensic evidence.
Detects the systemic deletion of Windows event logs using a tight loop with wevtutil.exe, a defense evasion tactic used by Kyber ransomware to impair investigations.
Detects when the security event log has been cleared by an account that is not the built-in system administrator (SID ending in 500). This activity is often performed by adversaries to remove traces of their actions.
Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs
Detects common late-stage ransomware indicators including the deletion of Volume Shadow Copies or the clearing of Windows Event Logs using vssadmin.exe or wevtutil.exe. These are reliable signals of imminent impact.
Detects clearing of Windows event logs. This can be used to hide what happened on a host.
Page 4 of 7