Detection rules › Splunk
Clear Windows Event Logs (PowerShell)
Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | |
| Defense Impairment |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| PowerShell | Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body
id: '5380.5490'
title: Clear Windows Event Logs
description: 'Adversaries may clear Windows Event Logs to hide the activity of an
intrusion. Windows Event Logs are a record of a computer''s alerts and notifications.
There are three system-defined sources of events: System, Application, and Security,
with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
-- Threat Actor Association: APT29/Nobelium, Cadet Blizzard, Lazarus, Memento Team,
Redfly, Vice Society, Volt Typhoon - Software Association: Blackcat/ALPHV, Cring,
Lockbit, Lorenz, Ransom Cartel, Rhysida, Trigona - Atomics T1070.001 Test#1 Atomics
T1070.001 Test#2 Atomics T1070.001 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` EventCode=4104 ((TERM(Clear-EventLog)
AND (TERM(-log) OR TERM(-logname))) OR ((TERM(wevtutil.exe) OR TERM(wevtutil)) AND
(TERM(CL)OR TERM(clear-log))) | table _time, host, user, signature_id, process_name,
process, user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:indicator removal:clear windows event logs
technique_id:
- T1070.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
- https://www.justice.gov/file/1080281/download