Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
17
17
8
4
3
Contributors
23
7
7
5
4
Categories
49
28
23
10
8
Platforms
54
1
Products / Services
45
35
22
15
9
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
Detects a sequence where a Codex agent process executes a shell or command interpreter, followed by logging or monitoring tampering activity on the same device within a 30-minute window.
The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments.
This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments.
This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs.
Clearing the event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
Clearing the event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
The following analytic detects the clearing of Windows event logs by identifying Windows Security Event ID 1102 or System log event 104. This detection leverages Windows event logs to monitor for log clearing activities. Such behavior is significant as it may indicate an attempt to cover tracks after malicious activities. If confirmed malicious, this action could hinder forensic investigations and allow attackers to persist undetected, making it crucial to investigate further and correlate with other alerts and data sources.
The following analytic detects the shutdown of the Windows Event Log service by leveraging Windows Event ID 1100. This event is logged every time the service stops, including during normal system shutdowns. Monitoring this activity is crucial as it can indicate attempts to cover tracks or disable logging. If confirmed malicious, an attacker could hide their activities, making it difficult to trace their actions and investigate further incidents. Analysts should verify if the shutdown was planned and review other alerts and data sources for additional suspicious behavior.
Detects attempts to clear Windows event logs using built-in utilities like wevtutil.exe, PowerShell commands (Clear-EventLog, Remove-EventLog), or the detection of Event ID 1102 (Log cleared). This activity is commonly used by adversaries, including ransomware affiliates, to obfuscate their tracks during or after an attack.
Detects the clearing of the Windows Security event log, which generates Event ID 1102. This action is often performed by adversaries to cover their tracks after performing malicious activities on a compromised host.
Detects unauthorized mass clearing of Windows Event Logs using wevtutil or PowerShell cmdlets. This behavior is often observed in ransomware campaigns (e.g., Nova, Gentlemen) as an anti-forensic measure to hinder incident response and investigation by removing audit trails across significant log channels like Security, System, and PowerShell.
Detects execution of common Windows utilities used by adversaries post-encryption to hinder system recovery and clear forensic evidence. This includes disabling the Windows Recovery Environment (ReAgentC), wiping disk free space (Cipher), clearing DNS caches, and clearing Windows Event Logs via Wevtutil or PowerShell.
Detects attempts to clear or delete Windows Event Logs using common utilities like wevtutil.exe, PowerShell cmdlets, or direct file system deletion of .evtx files.
Detects the clearing of Windows Event Logs via wevtutil, PowerShell, or registry modification, occurring within one hour of a remote interactive or network logon event on the same host. This pattern is indicative of anti-forensic activity often performed following lateral movement or prior to destructive actions like ransomware deployment.
Detects attempts to disable security services (Windows Defender, EDR agents), modify audit policies via auditpol, or stop/clear the Windows Event Log service. This behavior is a common precursor to post-compromise activity intended to blind defenders and conceal malicious actions.
Detects Windows Security (1102) or System (104) log clearing events that occur within 30 minutes of privileged activity (new account creation, group membership changes, or service installation) on the same host, sharply reducing false positives versus alerting on log clears alone.
Detects Windows Security (1102) or System (104) log clearing events that occur within 30 minutes of privileged activity (new account creation, group membership changes, or service installation) on the same host, sharply reducing false positives versus alerting on log clears alone.
Detects attempts by an adversary to disable or clear Windows Event logs using standard administrative utilities such as wevtutil, PowerShell, auditpol, net, sc, or wmic to cover tracks or hinder forensic analysis.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or PowerShell cmdlets 'Clear-EventLog' and 'Remove-EventLog'. Adversaries often perform this action to remove evidence of their presence or malicious activities from a compromised system.
Detects the clearing of Windows Security Event Logs (EventID 1102) within 15 minutes of a successful user logon (EventID 4624) on the same host. This activity is a common anti-forensics technique used by adversaries to hide malicious actions following an authenticated session.
Detects the clearing of Windows event logs using native 'wevtutil.exe' or PowerShell cmdlets. The rule monitors for common log-clearing commands and triggers an alert when multiple such events occur on a single host within a 15-minute window, which is indicative of bulk log-wiping often performed by ransomware or during post-exploitation defense evasion.
Detects the use of the wevtutil.exe utility to clear multiple Windows event logs simultaneously. This is a common defense evasion technique used by attackers to hide malicious activity by deleting security, system, application, or setup event logs.
Detects the clearing of the Windows Security Event Log. This activity is a common indicator of an adversary attempting to remove evidence of their presence or actions on a compromised host.
This rule detects attempts to clear Windows Event Logs using the 'wevtutil.exe' command-line utility or by identifying the generated Windows Security Event ID 1102 (Audit log was cleared). It tracks multiple instances of log clearing to identify suspicious bulk log deletion activity.
Page 1 of 3