Title:
Eventlog Cleared
Status:
test
Description:One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution
References:
-https://twitter.com/deviouspolack/status/832535435960209408
-https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100
Author: Florian Roth (Nextron Systems)
Date: 2017-01-10
modified:2023-11-15
Tags:
- -'attack.defense-impairment'
- -'attack.t1685.005'
- -'car.2016-04-002'
Logsource:
- product: windows
- service: system
Detection:
selection:
EventID:
'104'
Provider_Name:
'Microsoft-Windows-Eventlog'
filter_main_covered:
Channel:
-'Microsoft-Windows-PowerShell/Operational'
-'Microsoft-Windows-Sysmon/Operational'
-'PowerShellCore/Operational'
-'Security'
-'System'
-'Windows PowerShell'
condition:
selection and not 1 of filter_main_*
Falsepositives:
-Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
-System provisioning (system reset before the golden image creation)
Level:
medium
