Event log cleared using Diagnostics (via PowerShell)

Status: stable
Severity: high
Log source: category ['ps_module', 'ps_classic_script', 'ps_script'], product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to clear the event logs.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1070` Indicator Removal
Defense Impairment	`T1685.005` Disable or Modify Tools: Clear Windows Event Logs

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800

Rule body

title: Event log cleared using Diagnostics (via PowerShell)
description: Detects scenarios where an attacker attempts to clear the event logs.
references:
- hhttps://www.linkedin.com/feed/update/urn:li:activity:7143833994139283456/
- https://dscottraynsford.wordpress.com/2015/04/09/clear-all-windows-event-logs/
tags:
- attack.defense_evasion
- attack.t1070.001
author: mdecrevoisier
status: stable
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # full command: "get-winevent -ListLog * | % { [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($_.LogName) }"
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - System.Diagnostics.Eventing.Reader.EventLogSession
      - ClearLog

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - System.Diagnostics.Eventing.Reader.EventLogSession
      - ClearLog

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - System.Diagnostics.Eventing.Reader.EventLogSession
      - ClearLog

  condition: selection_powershell_native or selection_powershell_modern or selection_powershell_block
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection_powershell_native or selection_powershell_modern or selection_powershell_block

Stage 1: `selection_powershell_native`

selection_powershell_native:
  EventID: 800
  EventData|contains|all:
    - System.Diagnostics.Eventing.Reader.EventLogSession
    - ClearLog

Stage 2: `selection_powershell_modern`

selection_powershell_modern:
  EventID: 4103
  Payload|contains|all:
    - System.Diagnostics.Eventing.Reader.EventLogSession
    - ClearLog

Stage 3: `selection_powershell_block`

selection_powershell_block:
  EventID: 4104
  ScriptBlockText|contains|all:
    - System.Diagnostics.Eventing.Reader.EventLogSession
    - ClearLog

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`ClearLog` `System.Diagnostics.Eventing.Reader.EventLogSession`	`field:"EventData" kind:match`
`Payload`	match	`ClearLog` `System.Diagnostics.Eventing.Reader.EventLogSession`	`field:"Payload" kind:match`
`ScriptBlockText`	match	`ClearLog` corpus 2 (sigma 2) `System.Diagnostics.Eventing.Reader.EventLogSession`	`field:"ScriptBlockText" kind:match`

Event log cleared using Diagnostics (via PowerShell)

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_powershell_native

Stage 2: selection_powershell_modern

Stage 3: selection_powershell_block

Indicators

Stage 0: `condition`

Stage 1: `selection_powershell_native`

Stage 2: `selection_powershell_modern`

Stage 3: `selection_powershell_block`