Windows EVTX File Creation in Non-Standard Locations
Flags creation of .evtx files outside typical Windows event log directories to support event log evasion or export.
- Product
- windows
- Category
- file_event
- Author
- D3F7A5105 (SigmaHQ), DRL 1.1
- Published
- 2023-01-02
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies newly created files ending in .evtx that are written outside commonly expected Windows EVTX log directories. Creating EVTX files in unusual paths can indicate attempts to evade monitoring by moving or staging event logs for later inspection or exfiltration. It relies on file creation telemetry that includes the target filename path, with exclusions for a specific set of standard and container base image EVTX log locations.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows EVTX File Creation in Non-Standard Locations
id: c621be45-5b59-4c08-8296-42a2f319ce1a
status: test
description: This rule identifies newly created files ending in .evtx that are written outside commonly expected Windows EVTX log directories. Creating EVTX files in unusual paths can indicate attempts to evade monitoring by moving or staging event logs for later inspection or exfiltration. It relies on file creation telemetry that includes the target filename path, with exclusions for a specific set of standard and container base image EVTX log locations.
references:
- https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations.yml
author: D3F7A5105, Huntrule Team
date: 2023-01-02
modified: 2024-03-26
tags:
- attack.defense-impairment
- attack.t1685.001
logsource:
category: file_event
product: windows
definition: 'Requirements: The ".evtx" extension should be monitored via a Sysmon configuration. Example: <TargetFilename condition="end with">.evtx<TargetFilename>'
detection:
selection:
TargetFilename|endswith: .evtx
filter_main_path:
TargetFilename|startswith: C:\Windows\System32\winevt\Logs\
filter_main_baseimage:
TargetFilename|startswith: C:\ProgramData\Microsoft\Windows\Containers\BaseImages\
TargetFilename|endswith: \Windows\System32\winevt\Logs\
condition: selection and not 1 of filter_main_*
falsepositives:
- Administrator or backup activity
- An unknown bug seems to trigger the Windows "svchost" process to drop EVTX files in the "C:\Windows\Temp" directory in the form "<log_name">_<uuid>.evtx". See https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/info.yml
license: DRL-1.1
related:
- id: 65236ec7-ace0-4f0c-82fd-737b04fd4dcb
type: derived