PowerShell Write-EventLog with -RawData Flag
Alerts when PowerShell script blocks call Write-EventLog using the -RawData flag.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-16
- Updated
- 2026-07-31
What it detects
This rule flags PowerShell script content that invokes the Write-EventLog cmdlet with the -RawData flag. Attackers may use this functionality to store attacker-controlled data in the Windows Event Log for later retrieval or use, blending with legitimate logging activity. The detection relies on PowerShell script block text visibility matching both "Write-EventLog" and "-RawData " in the same script block.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
powershell-write-eventlog-with-rawdata-flag-35f41cd7
title: PowerShell Write-EventLog with -RawData Flag
id: 45424eca-27d9-4d01-b397-56110df1e775
status: test
description: This rule flags PowerShell script content that invokes the Write-EventLog cmdlet with the -RawData flag. Attackers may use this functionality to store attacker-controlled data in the Windows Event Log for later retrieval or use, blending with legitimate logging activity. The detection relies on PowerShell script block text visibility matching both "Write-EventLog" and "-RawData " in the same script block.
references:
- https://www.blackhillsinfosec.com/windows-event-logs-for-red-teams/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_write_eventlog.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-16
tags:
- attack.defense-impairment
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- Write-EventLog
- "-RawData "
condition: selection
falsepositives:
- Legitimate applications writing events via this cmdlet. Investigate alerts to determine if the action is benign
level: medium
license: DRL-1.1
related:
- id: 35f41cd7-c98e-469f-8a02-ec4ba0cc7a7e
type: derived