huntrule

Windows Event Log .evtx File Deletion from System32 winevt Logs

Flags deletion of Windows Event Log .evtx files under System32\winevt\Logs.

FreeUnreviewedSigmamediumv1
title: Windows Event Log .evtx File Deletion from System32 winevt Logs
id: 3da4cb75-2870-4f53-880c-22a579b65053
status: test
description: This rule identifies deletion events targeting Windows Event Log files (.evtx) within the System32 winevt Logs directory. Attackers may remove event log files to hinder forensic investigation and reduce traceability. The detection relies on file deletion telemetry that includes the deleted filename path.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_event_log_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-15
tags:
  - attack.stealth
  - attack.t1070
logsource:
  category: file_delete
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\Windows\System32\winevt\Logs\
    TargetFilename|endswith: .evtx
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 63c779ba-f638-40a0-a593-ddd45e8b1ddc
    type: derived

What it detects

This rule identifies deletion events targeting Windows Event Log files (.evtx) within the System32 winevt Logs directory. Attackers may remove event log files to hinder forensic investigation and reduce traceability. The detection relies on file deletion telemetry that includes the deleted filename path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.