Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
135 detections
Filters
Last updated
All Time
Detection languages
47
36
18
10
8
Contributors
41
27
11
11
11
Categories
103
67
64
25
16
Platforms
134
3
1
1
Products / Services
86
64
34
30
19
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
2
1
IDS Protocols
3
The analytic detects the shutdown of the Windows Event Log service by leveraging Windows Event ID 1100. This event is logged every time the service stops, including during normal system shutdowns. Monitoring this activity is crucial as it can indicate attempts to cover tracks or disable logging. If confirmed malicious, an attacker could hide their activities, making it difficult to trace their actions and investigate further incidents. Analysts should verify if the shutdown was planned and review other alerts and data sources for additional suspicious behavior.
The analytic detects the execution of "wevtutil.exe" with parameters to disable event logs. This activity is significant because disabling event logs is a common tactic used by ransomware to evade detection and hinder forensic investigations. If confirmed malicious, this action could allow attackers to operate undetected, making it difficult to trace their activities and respond effectively to the incident.
Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique is used by threat actors and ransomware strains to evade defenses by removing forensic evidence.
Detects the creation of new files with the ".evtx" extension in non-common or non-standard locations. This could indicate tampering with default EVTX locations to evade security controls or exfiltration of event logs to search for sensitive information. Note that backup software and legitimate administrators might perform similar actions during troubleshooting.
This rule detects when one of the Windows Event Logs has been cleared. This activity is often performed by adversaries to remove evidence of their presence and actions on a compromised system. The detection specifically looks for Event ID 104 from the 'Microsoft-Windows-Eventlog' provider, which indicates an event log has been cleared. It filters out certain channels that might be covered by other rules to avoid redundancy.
Detects when one of the critical Windows Event Logs (PowerShell, Sysmon, Security, System) is cleared. This activity is often performed by adversaries to remove traces of their actions and evade detection. The rule specifically looks for Event ID 104 from the 'Microsoft-Windows-Eventlog' provider across these important channels.
This rule detects when a Windows Event Log has been cleared. This activity is often performed by attackers to remove traces of their presence on a compromised system. The rule specifically looks for Event ID 517 from the 'Security' provider or Event ID 1102 from the 'Microsoft-Windows-Eventlog' provider, both of which indicate that an event log has been cleared. This can be caused by commands like 'wevtutil cl' or other methods of log manipulation.
Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
Detects the use of the WMI class "Win32_NTEventlogFile" within a PowerShell script to perform suspicious actions such as deleting, backing up, changing permissions, renaming, or taking ownership of event logs. This activity is often associated with defense evasion tactics by adversaries attempting to remove forensic evidence or impair system defenses.
Page 7 of 7