Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
17
17
8
4
3
Contributors
23
7
7
5
4
Categories
49
28
23
10
8
Platforms
54
1
Products / Services
45
35
22
15
9
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
Detects coordinated activity where a PowerShell process executes multiple distinct administrative utilities (such as wevtutil, vssadmin, wbadmin, or bcdedit) to perform destructive actions like clearing event logs, deleting shadow copies, or disabling system recovery settings. This rule uses correlation to identify sequences of at least three distinct commands and utilities, reducing false positives associated with single administrative tasks.
Detects efforts to clear Windows Event Logs using PowerShell (Clear-EventLog, EventLogSession.ClearLog) or wevtutil.exe (cl, clear-log). This behavior is characteristic of anti-forensic activities performed by ransomware like Nova to impede incident response and investigation efforts.
Detects evidence of log clearing or tampering activity associated with the GigaWiper destructive backdoor, specifically monitoring for the use of wevtutil to clear event logs, the manual deletion of the Security.evtx log file, or the presence of a specific marker string often utilized by this threat.
Detects evidence of log clearing or tampering activity associated with the GigaWiper destructive backdoor, specifically monitoring for the use of wevtutil to clear event logs, the manual deletion of the Security.evtx log file, or the presence of a specific marker string often utilized by this threat.
Detects evidence of log clearing or tampering activity associated with the GigaWiper destructive backdoor, specifically monitoring for the use of wevtutil to clear event logs, the manual deletion of the Security.evtx log file, or the presence of a specific marker string often utilized by this threat.
Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method.
Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated
when the WMI operation encounters an error (e.g. access denied, provider failure).
It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues.
Successful clearing operations will NOT produce this event; for those, correlate with
Security event 1102 or System event 104.
Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated
when the WMI operation encounters an error (e.g. access denied, provider failure).
It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues.
Successful clearing operations will NOT produce this event; for those, correlate with
Security event 1102 or System event 104.
Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".
This technique were seen used by threat actors and ransomware strains in order to evade defenses.
This technique were seen used by threat actors and ransomware strains in order to evade defenses.
One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution
Eventlog Cleared
Sigma
One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution
Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution
Detects the execution of "logman" utility in order to disable or delete Windows trace sessions
Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs
Page 3 of 3