Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript

Status: test
Severity: medium
Log source: category ps_script, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script

Known false positives

Legitimate administration and backup scripts

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	No specific technique

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript
id: e2812b49-bae0-4b21-b366-7c142eafcde2
status: test
description: Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-07-13
tags:
    - attack.defense-impairment
logsource:
    category: ps_script
    product: windows
    definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
    selection_class:
        ScriptBlockText|contains: 'Win32_NTEventlogFile'
    selection_function:
        ScriptBlockText|contains:
            - '.BackupEventlog('
            - '.ChangeSecurityPermissions('
            - '.ChangeSecurityPermissionsEx('
            - '.ClearEventLog('
            - '.Delete('
            - '.DeleteEx('
            - '.Rename('
            - '.TakeOwnerShip('
            - '.TakeOwnerShipEx('
    condition: all of selection_*
falsepositives:
    - Legitimate administration and backup scripts
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_class`

selection_class:
    ScriptBlockText|contains: 'Win32_NTEventlogFile'

Stage 2: `selection_function`

selection_function:
    ScriptBlockText|contains:
        - '.BackupEventlog('
        - '.ChangeSecurityPermissions('
        - '.ChangeSecurityPermissionsEx('
        - '.ClearEventLog('
        - '.Delete('
        - '.DeleteEx('
        - '.Rename('
        - '.TakeOwnerShip('
        - '.TakeOwnerShipEx('

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`.BackupEventlog(` `.ChangeSecurityPermissions(` `.ChangeSecurityPermissionsEx(` `.ClearEventLog(` `.Delete(` `.DeleteEx(` `.Rename(` `.TakeOwnerShip(` `.TakeOwnerShipEx(` `Win32_NTEventlogFile`	`field:"ScriptBlockText" kind:match`