huntrule

Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods

Flags PowerShell calling Win32_NTEventlogFile WMI methods commonly used to clear, delete, backup, or alter Windows event logs.

FreeUnreviewedSigmahighv1
title: Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods
id: bb023c4c-dca5-4327-8146-5db660c882ed
related:
  - id: e2812b49-bae0-4b21-b366-7c142eafcde2
    type: similar
  - id: caf201a9-c2ce-4a26-9c3a-2b9525413711
    type: derived
status: test
description: This rule flags PowerShell process activity where the command line references the WMI class Win32_NTEventlogFile and includes specific method calls associated with event log deletion, backup, renaming, ownership changes, security permission changes, or clearing. Such operations can help attackers impair or erase evidence from Windows event logs. The detection relies on process creation telemetry and matches the relevant WMI class and method names in the PowerShell command line.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_nteventlogfile_usage.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-13
tags:
  - attack.defense-impairment
logsource:
  category: process_creation
  product: windows
detection:
  selection_class:
    CommandLine|contains: Win32_NTEventlogFile
  selection_function:
    CommandLine|contains:
      - .BackupEventlog(
      - .ChangeSecurityPermissions(
      - .ChangeSecurityPermissionsEx(
      - .ClearEventLog(
      - .Delete(
      - .DeleteEx(
      - .Rename(
      - .TakeOwnerShip(
      - .TakeOwnerShipEx(
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags PowerShell process activity where the command line references the WMI class Win32_NTEventlogFile and includes specific method calls associated with event log deletion, backup, renaming, ownership changes, security permission changes, or clearing. Such operations can help attackers impair or erase evidence from Windows event logs. The detection relies on process creation telemetry and matches the relevant WMI class and method names in the PowerShell command line.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.