Windows Process Command Lines Query Event Logs via wevtutil, wmic, or PowerShell

Detects command-line attempts to query Windows Event Logs using wevtutil, wmic, or Get-WinEvent/Get-EventLog.

FreeUnreviewedSigmamediumv1

windows-process-command-lines-query-event-logs-via-wevtutil-wmic-or-powershell-9cd55b6c

title: Windows Process Command Lines Query Event Logs via wevtutil, wmic, or PowerShell
id: dc9d12c8-c41f-45fe-9282-22fe73a01467
related:
  - id: beaa66d6-aa1b-4e3c-80f5-e0145369bfaf
    type: derived
  - id: 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f
    type: derived
status: test
description: This rule flags Windows process creation events where the command line suggests querying Event Log contents using built-in utilities. Attackers may enumerate log data to find sensitive information such as usernames, IPs, or credential-related artifacts. Detection relies on process image/original filename matching for wevtutil.exe and wmic.exe, plus command-line substrings indicating event log query activity, including Win32_NTLogEvent and PowerShell cmdlets.
references:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1
  - http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_event_log_query.yml
author: Ali Alwashali, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-20
modified: 2024-01-24
tags:
  - attack.t1552
  - attack.credential-access
  - detection.threat-hunting
logsource:
  product: windows
  category: process_creation
detection:
  selection_wmi:
    CommandLine|contains|all:
      - Select
      - Win32_NTLogEvent
  selection_wevtutil_img:
    - Image|endswith: \wevtutil.exe
    - OriginalFileName: wevtutil.exe
  selection_wevtutil_cli:
    CommandLine|contains:
      - " qe "
      - " query-events "
  selection_wmic_img:
    - Image|endswith: \wmic.exe
    - OriginalFileName: wmic.exe
  selection_wmic_cli:
    CommandLine|contains: " ntevent"
  selection_cmdlet:
    CommandLine|contains:
      - "Get-WinEvent "
      - "get-eventlog "
  condition: selection_wmi or all of selection_wevtutil_* or all of selection_wmic_* or selection_cmdlet
falsepositives:
  - Legitimate log access by administrators or troubleshooting tools
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the command line suggests querying Event Log contents using built-in utilities. Attackers may enumerate log data to find sensitive information such as usernames, IPs, or credential-related artifacts. Detection relies on process image/original filename matching for wevtutil.exe and wmic.exe, plus command-line substrings indicating event log query activity, including Win32_NTLogEvent and PowerShell cmdlets.

Known false positives

Legitimate log access by administrators or troubleshooting tools

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.