Windows EVTX File Creation in Non-Standard Locations

Flags creation of .evtx files outside typical Windows event log directories to support event log evasion or export.

FreeUnreviewedSigmamediumv1

windows-evtx-file-creation-in-non-standard-locations-65236ec7

title: Windows EVTX File Creation in Non-Standard Locations
id: c621be45-5b59-4c08-8296-42a2f319ce1a
status: test
description: This rule identifies file creation events where the target filename ends with .evtx but the file is not created within common Windows event log paths. Attackers may write event log exports or copies to unusual directories to evade monitoring or to locate/extract sensitive event data. The detection relies on Windows file event telemetry that includes the created target filename and path, using filename extension matching plus exclusions for common EVTX locations.
references:
  - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations.yml
author: D3F7A5105, Huntrule Team
date: 2023-01-02
modified: 2024-03-26
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: file_event
  product: windows
  definition: 'Requirements: The ".evtx" extension should be monitored via a Sysmon configuration. Example: <TargetFilename condition="end with">.evtx<TargetFilename>'
detection:
  selection:
    TargetFilename|endswith: .evtx
  filter_main_path:
    TargetFilename|startswith: C:\Windows\System32\winevt\Logs\
  filter_main_baseimage:
    TargetFilename|startswith: C:\ProgramData\Microsoft\Windows\Containers\BaseImages\
    TargetFilename|endswith: \Windows\System32\winevt\Logs\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Administrator or backup activity
  - An unknown bug seems to trigger the Windows "svchost" process to drop EVTX files in the "C:\Windows\Temp" directory in the form "<log_name">_<uuid>.evtx". See https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/info.yml
license: DRL-1.1
related:
  - id: 65236ec7-ace0-4f0c-82fd-737b04fd4dcb
    type: derived

What it detects

This rule identifies file creation events where the target filename ends with .evtx but the file is not created within common Windows event log paths. Attackers may write event log exports or copies to unusual directories to evade monitoring or to locate/extract sensitive event data. The detection relies on Windows file event telemetry that includes the created target filename and path, using filename extension matching plus exclusions for common EVTX locations.

Known false positives

Administrator or backup activity
An unknown bug seems to trigger the Windows "svchost" process to drop EVTX files in the "C:\Windows\Temp" directory in the form "<log_name">_<uuid>.evtx". See https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.