EVTX Created In Unusual Location (via file_event)

title: EVTX Created In Unusual Location (via file_event)
id: b59c77b1-cc01-5d3a-945f-79570c910b80
status: stable
description: This rule detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1685/001/
    - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key
author: Huntrule Team
date: 2026-03-23
tags:
    - attack.defense-impairment
    - attack.t1685.001
logsource:
    category: file_event
    product: windows
    definition: 'Requirements: The ".evtx" extension should be monitored via a Sysmon configuration. Example: <TargetFilename condition="end with">.evtx<TargetFilename>'
detection:
    selection:
        TargetFilename|endswith: '.evtx'
    filter_main_path:
        TargetFilename|startswith: 'C:\Windows\System32\winevt\Logs\'
    filter_main_baseimage:
        TargetFilename|startswith: 'C:\ProgramData\Microsoft\Windows\Containers\BaseImages\'
        TargetFilename|endswith: '\Windows\System32\winevt\Logs\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/info.yml