Potentially Suspicious Call To Win32_NTEventlogFile Class

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Potentially Suspicious Call To Win32_NTEventlogFile Class
id: caf201a9-c2ce-4a26-9c3a-2b9525413711
related:
    - id: e2812b49-bae0-4b21-b366-7c142eafcde2
      type: similar
status: test
description: Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-07-13
tags:
    - attack.defense-impairment
logsource:
    category: process_creation
    product: windows
detection:
    selection_class:
        CommandLine|contains: 'Win32_NTEventlogFile'
    selection_function:
        CommandLine|contains:
            - '.BackupEventlog('
            - '.ChangeSecurityPermissions('
            - '.ChangeSecurityPermissionsEx('
            - '.ClearEventLog('
            - '.Delete('
            - '.DeleteEx('
            - '.Rename('
            - '.TakeOwnerShip('
            - '.TakeOwnerShipEx('
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_class`

selection_class:
    CommandLine|contains: 'Win32_NTEventlogFile'

Stage 2: `selection_function`

selection_function:
    CommandLine|contains:
        - '.BackupEventlog('
        - '.ChangeSecurityPermissions('
        - '.ChangeSecurityPermissionsEx('
        - '.ClearEventLog('
        - '.Delete('
        - '.DeleteEx('
        - '.Rename('
        - '.TakeOwnerShip('
        - '.TakeOwnerShipEx('

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`.BackupEventlog(` `.ChangeSecurityPermissions(` `.ChangeSecurityPermissionsEx(` `.ClearEventLog(` `.Delete(` `.DeleteEx(` `.Rename(` `.TakeOwnerShip(` `.TakeOwnerShipEx(` `Win32_NTEventlogFile`	`field:"CommandLine" kind:match`