Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
17
17
8
4
3
Contributors
23
7
7
5
4
Categories
49
28
23
10
8
Platforms
54
1
Products / Services
45
35
22
15
9
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
Detects attempts to clear Windows event logs using built-in utilities such as wevtutil.exe or PowerShell cmdlets (Clear-EventLog, Clear-WinEvent). Adversaries often perform this action to remove traces of malicious activity from the system.
Detects the use of the 'wevtutil.exe' utility to clear Windows Event Logs. This is a common technique used by adversaries to disrupt logging and evade detection of their actions on a host. The rule specifically monitors for the 'cl' (clear-log) command applied to sensitive operational channels, triggering when multiple clearing operations are detected within a 5-minute window.
Detects attempts to clear Windows event logs using administrative tools like wevtutil.exe, PowerShell, or through the detection of mass log-clear audit events (such as Event IDs 1102 and 104) occurring in a rapid burst. This activity is often used by adversaries to hide evidence of post-compromise actions.
Detects multiple defense evasion techniques typically associated with the Monkey ransomware family, including clearing Windows Event Logs, clearing PowerShell command history, tampering with AMSI and ETW, modifying Microsoft Defender exclusions, and disabling Task Manager or CMD via registry keys.
Detects the use of wevtutil.exe to clear the Microsoft-Windows-Defender/Operational event log, which is often done by adversaries to remove evidence of security software activity or detection.
Detects potential anti-forensic activity involving the clearing of multiple Windows Event Logs within a short time frame using the 'wevtutil' utility. This behavior is often indicative of an adversary attempting to remove traces of post-compromise activity.
Detects attempts to clear Windows event logs using administrative tools like wevtutil.exe, PowerShell, or through the detection of mass log-clear audit events (such as Event IDs 1102 and 104) occurring in a rapid burst. This activity is often used by adversaries to hide evidence of post-compromise actions.
Detects attempts to clear Windows event logs using administrative tools like wevtutil.exe, PowerShell, or through the detection of mass log-clear audit events (such as Event IDs 1102 and 104) occurring in a rapid burst. This activity is often used by adversaries to hide evidence of post-compromise actions.
Detects potential tampering with Windows Event Logs or audit services by correlating manual service stops or log clearing events (EventIDs 1100, 1102, 104, 7036, 7040) with a sudden, significant decrease in total event volume on the same host. The rule accounts for planned maintenance and legitimate event log service restarts to reduce noise.
This rule monitors for suspicious process execution patterns that suggest system tampering, security tool evasion, or data concealment. It detects activities such as clearing event logs, modifying Windows Defender preferences (exclusions/real-time monitoring), creating suspicious scheduled tasks, deleting volume shadow copies, and using PowerShell for credential or system state manipulation.
This rule monitors for a collection of adversarial behaviors on Windows systems, including persistence mechanisms via scheduled tasks and registry run keys, tampering with security services (VSS, Windows Defender), credential harvesting attempts (LSASS memory), log and history clearing, and external network communication to known IP geolocation services.
Detects potential tampering with Windows Event Logs or audit services by correlating manual service stops or log clearing events (EventIDs 1100, 1102, 104, 7036, 7040) with a sudden, significant decrease in total event volume on the same host. The rule accounts for planned maintenance and legitimate event log service restarts to reduce noise.
Detects potential tampering with Windows Event Logs or audit services by correlating manual service stops or log clearing events (EventIDs 1100, 1102, 104, 7036, 7040) with a sudden, significant decrease in total event volume on the same host. The rule accounts for planned maintenance and legitimate event log service restarts to reduce noise.
Detects potential tampering with Windows Event Logs or audit services by correlating manual service stops or log clearing events (EventIDs 1100, 1102, 104, 7036, 7040) with a sudden, significant decrease in total event volume on the same host. The rule accounts for planned maintenance and legitimate event log service restarts to reduce noise.
Detects potential tampering with Windows Event Logs or audit services by correlating manual service stops or log clearing events (EventIDs 1100, 1102, 104, 7036, 7040) with a sudden, significant decrease in total event volume on the same host. The rule accounts for planned maintenance and legitimate event log service restarts to reduce noise.
Detects the frequent clearing of specific Windows Event Logs using the built-in wevtutil.exe utility. Attackers often clear logs to hide evidence of post-exploitation activity such as credential access, lateral movement, or persistence installation.
Detects the execution of the Windows Event Utility (wevtutil.exe) with the 'cl' (clear-log) command, specifically targeting multiple critical event logs simultaneously. This behavior is indicative of anti-forensic activity aimed at obfuscating post-compromise actions, as seen in the Settra ransomware campaign.
Detects the use of the 'wevtutil.exe' command to clear Windows Event Logs where the command specifies a misspelled event log name, 'Microsoft-Windows-Defender/Operational' instead of the correct 'Microsoft-Windows-Windows-Defender/Operational'. This specific spelling error is associated with the Settra ransomware and indicates an unsuccessful attempt to clear Windows Defender logs.
Detects the suspicious sequential execution of the 'wevtutil cl' command to clear multiple critical Windows Event Log channels, including security, system, and application logs. This behavior is indicative of anti-forensic activities performed by adversaries, such as the Settra ransomware, to hinder incident response and forensic analysis.
Detects the use of the wevtutil.exe utility to clear specific Windows Event Logs. Adversaries may clear event logs to hide evidence of malicious activity on a system.
Detects the clearing of Windows event logs using the native 'wevtutil.exe' command or the PowerShell 'Clear-EventLog' cmdlet. This activity is commonly associated with anti-forensic techniques used by threat actors and wiper malware to obstruct incident response efforts and remove traces of malicious activity.
Page 2 of 3