Suspicious PowerShell Write-EventLog Use (via ps_script)

title: Suspicious PowerShell Write-EventLog Use (via ps_script)
id: 7bf46d10-1170-5e93-be55-3fa89bf4c71a
status: stable
description: This rule detects use of the "Write-EventLog" cmdlet with 'RawData' flag. The cmdlet can be levreage to write hostile payloads to the EventLog and then retrieve them later for later use
references:
    - https://www.blackhillsinfosec.com/windows-event-logs-for-red-teams/
author: Huntrule Team
date: 2026-04-14
tags:
    - attack.defense-impairment
    - attack.defense-evasion
    - attack.t1027
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'Write-EventLog'
            - '-RawData '
    condition: selection
falsepositives:
    - Unknown
level: medium