huntrule

SharpEvtMute Execution via Process Creation on Windows

Alerts on SharpEvtMute.exe runs with event-log filter and encoded command-line parameters on Windows.

FreeUnreviewedSigmahighv1
title: SharpEvtMute Execution via Process Creation on Windows
id: bf508c52-5672-4f45-b2ea-f720c881f019
related:
  - id: 49329257-089d-46e6-af37-4afce4290685
    type: similar
  - id: bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c
    type: derived
status: test
description: This rule flags the execution of SharpEvtMute.exe, a utility associated with tampering with Windows event logs. Attackers may use it to impair or conceal their activity by interfering with event logging. It relies on Windows process creation telemetry, matching the executable name, process description, and specific command-line arguments/encoding patterns.
references:
  - https://github.com/bats3c/EvtMute
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpevtmute.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-07
modified: 2023-02-14
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Image|endswith: \SharpEvtMute.exe
    - Description: SharpEvtMute
    - CommandLine|contains:
        - '--Filter "rule '
        - --Encoded --Filter \"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags the execution of SharpEvtMute.exe, a utility associated with tampering with Windows event logs. Attackers may use it to impair or conceal their activity by interfering with event logging. It relies on Windows process creation telemetry, matching the executable name, process description, and specific command-line arguments/encoding patterns.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.