Detection rules › By catalog entry

Microsoft-Windows-Eventlog

Catalog entry	Rules
Event ID 104	6
Event ID 517	2
Event ID 1100	1
Event ID 1102	8

Event ID 104

6 detection rules reference this catalog entry. View catalog entry.

Sigma (3)

Event log cleared (native) severity high T1070,T1685.005
Eventlog Cleared severity medium T1685,T1685.005
Important Windows Eventlog Cleared severity high T1685,T1685.005

Elastic (1)

Windows Event Logs Cleared severity low T1070,T1685.005

Splunk (2)

Clear Windows Event Logs (Windows Event Log) T1070,T1685.005
Windows Event Log Cleared severity medium T1685,T1685.005

Event ID 517

2 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Security Eventlog Cleared severity high T1685,T1685.005

Splunk (1)

Clear Windows Event Logs (Windows Event Log) T1070,T1685.005

Event ID 1100

1 detection rules reference this catalog entry. View catalog entry.

Splunk (1)

Windows Event Logging Service Has Shutdown T1685,T1685.005

Event ID 1102

8 detection rules reference this catalog entry. View catalog entry.

Sigma (2)

Event log cleared (native) severity high T1070,T1685.005
Security Eventlog Cleared severity high T1685,T1685.005

Elastic (1)

Windows Event Logs Cleared severity low T1070,T1685.005

Splunk (2)

Clear Windows Event Logs (Windows Event Log) T1070,T1685.005
Windows Event Log Cleared severity medium T1685,T1685.005

Kusto (2)

NRT Security Event log cleared severity medium T1070
Security Event log cleared severity medium T1070

YARA-L (1)

Windows Event Log Cleared severity medium T1070,T1685.005

Back to all Microsoft-Windows-Eventlog catalog entries