Windows EVTX File Creation in Non-Standard Locations

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies newly created files ending in .evtx that are written outside commonly expected Windows EVTX log directories. Creating EVTX files in unusual paths can indicate attempts to evade monitoring by moving or staging event logs for later inspection or exfiltration. It relies on file creation telemetry that includes the target filename path, with exclusions for a specific set of standard and container base image EVTX log locations.

Reporting behind it

Related detections9 linkedT1685.001 — drag to rearrange

Malicious Security Event Log Disabled via wevtutil

Malicious SQL Server Auditing Deactivated (via application)

Malicious Event Log Deactivation or Size Reduction - Command (via process_creation)

Malicious Audit Policy Disabled by Command Line (via process_creation)

Suspicious IIS Logging Disabled via appcmd

Malicious SQL Server Database Auditing Deactivated (via application)

Malicious Audit Policy Disabled by Command Line (via security)

Malicious Event Log Tampering via wevtutil Channel Disable by FunkSec Ransomware (via process_creation)

OCSP Responder Auditing Settings Changed or Disabled (via security)

Windows EVTX File Creation in Non-Standard Locations

Pivot detection · T1685.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-evtx-file-creation-in-non-standard-locations-65236ec7

title: Windows EVTX File Creation in Non-Standard Locations
id: c621be45-5b59-4c08-8296-42a2f319ce1a
status: test
description: This rule identifies newly created files ending in .evtx that are written outside commonly expected Windows EVTX log directories. Creating EVTX files in unusual paths can indicate attempts to evade monitoring by moving or staging event logs for later inspection or exfiltration. It relies on file creation telemetry that includes the target filename path, with exclusions for a specific set of standard and container base image EVTX log locations.
references:
  - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations.yml
author: D3F7A5105, Huntrule Team
date: 2023-01-02
modified: 2024-03-26
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: file_event
  product: windows
  definition: 'Requirements: The ".evtx" extension should be monitored via a Sysmon configuration. Example: <TargetFilename condition="end with">.evtx<TargetFilename>'
detection:
  selection:
    TargetFilename|endswith: .evtx
  filter_main_path:
    TargetFilename|startswith: C:\Windows\System32\winevt\Logs\
  filter_main_baseimage:
    TargetFilename|startswith: C:\ProgramData\Microsoft\Windows\Containers\BaseImages\
    TargetFilename|endswith: \Windows\System32\winevt\Logs\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Administrator or backup activity
  - An unknown bug seems to trigger the Windows "svchost" process to drop EVTX files in the "C:\Windows\Temp" directory in the form "<log_name">_<uuid>.evtx". See https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/info.yml
license: DRL-1.1
related:
  - id: 65236ec7-ace0-4f0c-82fd-737b04fd4dcb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL