Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
135 detections
Filters
Last updated
All Time
Detection languages
47
36
18
10
8
Contributors
41
27
11
11
11
Categories
103
67
64
25
16
Platforms
134
3
1
1
Products / Services
86
64
34
30
19
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
2
1
IDS Protocols
3
Detects command-line tools and scripts used to clear Windows Event Logs, indicating potential anti-forensics activity to hide evidence of malicious actions.
This rule detects various stages of an attack chain, starting from an Apache ActiveMQ exploit (CVE-2023-46604) leading to LockBit-style ransomware. It identifies process creation anomalies (java.exe spawning certutil.exe for downloads), network connections to known Metasploit C2 infrastructure, the presence of specific ransomware file hashes, and attempts to clear Windows event logs, all indicative of the described attack scenario.
The rule detects when Windows Event Logs are cleared. Specifically, it looks for Event ID 1102, which indicates the Security log was cleared, or Event ID 104, which indicates the System log was cleared. This activity is often associated with anti-forensics techniques to hide malicious actions.
A composite detection rule that identifies multiple techniques, tactics, and procedures (TTPs) associated with the RansomHub intrusion detailed in "The DFIR Report". This rule focuses on process creation events and flags the execution of specific credential dumping tools, network scanners, defense evasion commands, ransomware behaviors, and exfiltration tool chains. An alert from this rule indicates a high probability of malicious activity consistent with this threat actor's methodology.
Detects usage of known PowerShell cmdlets such as "Clear-EventLog", "Remove-EventLog", "Limit-EventLog", "Clear-WinEvent", or direct .NET calls to clear Windows event logs. This activity is often performed by adversaries to remove forensic evidence of their actions on a compromised system.
Detects the execution of multiple commands commonly used by Dire Wolf ransomware to delete backups, shadow copies, and event logs, thereby inhibiting system recovery. The rule triggers when more than one of these anti-recovery commands are executed on the same host within a 10-minute window, distinguishing malicious patterns from isolated, legitimate administrative actions.
Detects scenarios where an attacker attempts to clear the event logs.
Detects scenarios where an attacker attempts to clear the event logs.
Detects scenarios where an attacker cleared the event logs.
Detects the use of the PsLogList utility to dump Windows event logs (security, application, system) or to clear them. This activity can be indicative of account discovery attempts or anti-forensics techniques by adversaries.
The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
Detects attempts to remove traces of Remote Desktop Protocol (RDP) activity by clearing specific event logs, deleting registry keys, or removing cache files. This rule identifies command-line actions using 'wevtutil' to clear RDP operational logs, 'reg delete' for RDP client registry keys, and 'del' or 'remove-item' for RDP bitmap cache files. It also directly monitors registry events for RDP client key deletions and file events for RDP cache file deletions.
KQL Query from file: PowerShell-Based Event Log Clearing
Detects the execution of DragonForce ransomware binary or its associated event log clearing batch script, as observed in attacks leveraging SimpleHelp vulnerabilities.
KQL Query from file: Detecting Abuse of Wevtutil.exe in LOLBAS Attacks
KQL Query
One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution
Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs
Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
Detects the execution of "logman" utility in order to disable or delete Windows trace sessions
Page 5 of 7