Suspicious PowerShell WMI Win32_NTEventlogFile Usage (Event Log Tampering)
Detects PowerShell scripts calling Win32_NTEventlogFile methods associated with event log deletion, backup, renaming, or permission changes.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-13
- Updated
- 2026-07-31
What it detects
This rule flags PowerShell script activity that references the Win32_NTEventlogFile WMI class and includes operations consistent with event log tampering such as delete, clear, rename, backup, ownership changes, or security permission changes. Attackers may impair detection and forensic recovery by manipulating Windows event logs, so this script-level behavior is a high-signal indicator. Telemetry relies on PowerShell ScriptBlockText content that contains the WMI class name along with specific method calls indicative of log modification.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Suspicious PowerShell WMI Win32_NTEventlogFile Usage (Event Log Tampering)
id: bb9798a1-2698-4416-86b6-579c653a4b0e
status: test
description: This rule flags PowerShell script activity that references the Win32_NTEventlogFile WMI class and includes operations consistent with event log tampering such as delete, clear, rename, backup, ownership changes, or security permission changes. Attackers may impair detection and forensic recovery by manipulating Windows event logs, so this script-level behavior is a high-signal indicator. Telemetry relies on PowerShell ScriptBlockText content that contains the WMI class name along with specific method calls indicative of log modification.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_win32_nteventlogfile_usage.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-13
tags:
- attack.defense-impairment
logsource:
category: ps_script
product: windows
definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
selection_class:
ScriptBlockText|contains: Win32_NTEventlogFile
selection_function:
ScriptBlockText|contains:
- .BackupEventlog(
- .ChangeSecurityPermissions(
- .ChangeSecurityPermissionsEx(
- .ClearEventLog(
- .Delete(
- .DeleteEx(
- .Rename(
- .TakeOwnerShip(
- .TakeOwnerShipEx(
condition: all of selection_*
falsepositives:
- Legitimate administration and backup scripts
level: medium
license: DRL-1.1
related:
- id: e2812b49-bae0-4b21-b366-7c142eafcde2
type: derived