PowerShell: Suspicious WMI Win32_NTEventlogFile Usage in Script

Detects PowerShell scripts calling Win32_NTEventlogFile methods associated with event log deletion, backup, renaming, or permission changes.

FreeUnreviewedSigmamediumv1

powershell-suspicious-wmi-win32-nteventlogfile-usage-in-script-e2812b49

title: "PowerShell: Suspicious WMI Win32_NTEventlogFile Usage in Script"
id: bb9798a1-2698-4416-86b6-579c653a4b0e
status: test
description: This rule flags PowerShell script content that references the WMI class Win32_NTEventlogFile and pairs it with event log manipulation or permission changes such as BackupEventlog, ClearEventLog, Delete, Rename, TakeOwnerShip, and ChangeSecurityPermissions variants. Attackers may use these actions to impair or remove evidence in Windows event logs during intrusion and post-exploitation. It relies on PowerShell script block text telemetry that captures both the presence of Win32_NTEventlogFile and the specific method calls associated with tampering.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_win32_nteventlogfile_usage.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-13
tags:
  - attack.defense-impairment
logsource:
  category: ps_script
  product: windows
  definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
  selection_class:
    ScriptBlockText|contains: Win32_NTEventlogFile
  selection_function:
    ScriptBlockText|contains:
      - .BackupEventlog(
      - .ChangeSecurityPermissions(
      - .ChangeSecurityPermissionsEx(
      - .ClearEventLog(
      - .Delete(
      - .DeleteEx(
      - .Rename(
      - .TakeOwnerShip(
      - .TakeOwnerShipEx(
  condition: all of selection_*
falsepositives:
  - Legitimate administration and backup scripts
level: medium
license: DRL-1.1
related:
  - id: e2812b49-bae0-4b21-b366-7c142eafcde2
    type: derived

What it detects

This rule flags PowerShell script content that references the WMI class Win32_NTEventlogFile and pairs it with event log manipulation or permission changes such as BackupEventlog, ClearEventLog, Delete, Rename, TakeOwnerShip, and ChangeSecurityPermissions variants. Attackers may use these actions to impair or remove evidence in Windows event logs during intrusion and post-exploitation. It relies on PowerShell script block text telemetry that captures both the presence of Win32_NTEventlogFile and the specific method calls associated with tampering.

Known false positives

Legitimate administration and backup scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.