Detection rules › Sigma

Event log clear attempt (wmi)

Status
experimental
Severity
high
Log source
product windows, category process_creation
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to clear the event logs.

MITRE ATT&CK coverage

Event coverage

Rule body yaml

title: Event log clear attempt (wmi)
description: Detects scenarios where an attacker attempts to clear the event logs.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1070.001-Clear%20Windows%20event%20logs
- https://www.windows-commandline.com/backup-delete-event-log-files/
- https://lolbas-project.github.io/lolbas/Binaries/Wmic/
tags:
- attack.defense_evasion
- attack.t1070.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection: # full command: "wmic nteventlog where filename="security" cleareventlog"
  selection:
    NewProcessName|endswith: '\WMIC.exe'
    CommandLine|contains|all:
      - wmic
      - cleareventlog
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  NewProcessName|endswith: '\WMIC.exe'
  CommandLine|contains|all:
    - wmic
    - cleareventlog

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • cleareventlog corpus 2 (sigma 2)
  • wmic corpus 6 (sigma 6)
NewProcessNameends_with
  • \WMIC.exe corpus 60 (sigma 60)