detection.wiki

Detection rules › Splunk

Clear Windows Event Logs (Windows Event Log)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit

MITRE ATT&CK coverage

TacticTechniques
StealthT1070.001 Indicator Removal: Clear Windows Event Logs

References

Event coverage

ProviderEventTitle
EventlogEvent ID 104The LogFileCleared.Channel log file was cleared.
EventlogEvent ID 517The audit log was cleared (legacy Windows 2000/XP/2003 event; superseded by 1102).
EventlogEvent ID 1102The audit log was cleared.

Rule body yaml

id: '5380.5489'
title: Clear Windows Event Logs
description: 'Adversaries may clear Windows Event Logs to hide the activity of an
  intrusion. Windows Event Logs are a record of a computer''s alerts and notifications.
  There are three system-defined sources of events: System, Application, and Security,
  with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
  -- Threat Actor Association: APT29/Nobelium, Cadet Blizzard, Lazarus, Memento Team,
  Redfly, Vice Society, Volt Typhoon - Software Association: Blackcat/ALPHV, Cring,
  Lockbit, Lorenz, Ransom Cartel, Rhysida, Trigona - Atomics T1070.001 Test#1 Atomics
  T1070.001 Test#2 Atomics T1070.001 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=1102 OR "<EventID>1102<"
  OR EventCode=517 OR "<EventID>517<" OR EventCode=104 OR "<EventID>104<") | table
  _time, host, user, signature_id, process_name, process, user, name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:indicator removal:clear windows event logs
technique_id:
- T1070.001
data_category:
- Windows event logs
references:
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
- https://www.justice.gov/file/1080281/download

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=1102 OR "<EventID>1102<" OR EventCode=517 OR "<EventID>517<" OR EventCode=104 OR "<EventID>104<")

Stage 2: table

| table _time, host, user, signature_id, process_name, process, user, name

Stage 3: bucket

| bin span=1s

Stage 4: stats

| stats values(*) as * by _time, host

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 104 corpus 2 (splunk 2)
  • 1102 corpus 4 (splunk 2, kusto 2)
  • 517

Search terms

Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.

StageTerm
1"<EventID>1102<"
1"<EventID>517<"
1"<EventID>104<"