Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods
Flags PowerShell calling Win32_NTEventlogFile WMI methods commonly used to clear, delete, backup, or alter Windows event logs.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-13
- Updated
- 2026-07-30
What it detects
This rule flags PowerShell process activity where the command line references the WMI class Win32_NTEventlogFile and includes specific method calls associated with event log deletion, backup, renaming, ownership changes, security permission changes, or clearing. Such operations can help attackers impair or erase evidence from Windows event logs. The detection relies on process creation telemetry and matches the relevant WMI class and method names in the PowerShell command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods
id: bb023c4c-dca5-4327-8146-5db660c882ed
related:
- id: e2812b49-bae0-4b21-b366-7c142eafcde2
type: similar
- id: caf201a9-c2ce-4a26-9c3a-2b9525413711
type: derived
status: test
description: This rule flags PowerShell process activity where the command line references the WMI class Win32_NTEventlogFile and includes specific method calls associated with event log deletion, backup, renaming, ownership changes, security permission changes, or clearing. Such operations can help attackers impair or erase evidence from Windows event logs. The detection relies on process creation telemetry and matches the relevant WMI class and method names in the PowerShell command line.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_nteventlogfile_usage.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-13
tags:
- attack.defense-impairment
logsource:
category: process_creation
product: windows
detection:
selection_class:
CommandLine|contains: Win32_NTEventlogFile
selection_function:
CommandLine|contains:
- .BackupEventlog(
- .ChangeSecurityPermissions(
- .ChangeSecurityPermissionsEx(
- .ClearEventLog(
- .Delete(
- .DeleteEx(
- .Rename(
- .TakeOwnerShip(
- .TakeOwnerShipEx(
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1