PowerShell Write-EventLog with RawData Flag

Alerts when PowerShell script blocks call Write-EventLog using the -RawData flag.

FreeUnreviewedSigmamediumv1

powershell-write-eventlog-with-rawdata-flag-35f41cd7

title: PowerShell Write-EventLog with RawData Flag
id: 45424eca-27d9-4d01-b397-56110df1e775
status: test
description: This rule flags PowerShell script block content that uses the Write-EventLog cmdlet with a RawData flag. Attackers can use this to write attacker-controlled data into the Windows Event Log for later retrieval or use. The detection relies on Script Block Logging telemetry capturing the presence of both Write-EventLog and the '-RawData ' argument in the same script block.
references:
  - https://www.blackhillsinfosec.com/windows-event-logs-for-red-teams/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_write_eventlog.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-16
tags:
  - attack.defense-impairment
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Write-EventLog
      - "-RawData "
  condition: selection
falsepositives:
  - Legitimate applications writing events via this cmdlet. Investigate alerts to determine if the action is benign
level: medium
license: DRL-1.1
related:
  - id: 35f41cd7-c98e-469f-8a02-ec4ba0cc7a7e
    type: derived

What it detects

This rule flags PowerShell script block content that uses the Write-EventLog cmdlet with a RawData flag. Attackers can use this to write attacker-controlled data into the Windows Event Log for later retrieval or use. The detection relies on Script Block Logging telemetry capturing the presence of both Write-EventLog and the '-RawData ' argument in the same script block.

Known false positives

Legitimate applications writing events via this cmdlet. Investigate alerts to determine if the action is benign

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.