Windows Process Creation Recon via Event Log Query Tools and Event ID Searches
Flags Windows processes running event log query utilities and commands that search specific event IDs or dump log content.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-09
- Updated
- 2026-07-30
ATT&CK techniques
Cred Access → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies potentially suspicious process executions on Windows where log query utilities and commands are used to search for or extract data from Windows Event Logs, including queries by specific event IDs. Attackers may use these commands to enumerate events and pull sensitive information such as user activity, session details, or host and IP context. It relies on process creation telemetry, matching command line content for tools and query patterns across wevtutil, wmic, PowerShell cmdlets, and WMI event queries.
Reporting behind it
- blog.talosintelligence.comhttp://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
- thedfirreport.comhttps://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- cisa.govhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
- group-ib.comhttps://www.group-ib.com/blog/apt41-world-tour-2021/
- labs.withsecure.comhttps://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1
- solomonson.comhttp://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
- ptsecurity.comhttps://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today
- cybertriage.comhttps://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/
- ponderthebits.comhttps://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-recon-via-event-log-query-tools-and-event-id-searches-beaa66d6
title: Windows Process Creation Recon via Event Log Query Tools and Event ID Searches
id: a3efe766-ec22-45ac-b336-c0c9fcdf37cf
related:
- id: 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f
type: derived
- id: beaa66d6-aa1b-4e3c-80f5-e0145369bfaf
type: derived
status: test
description: This rule identifies potentially suspicious process executions on Windows where log query utilities and commands are used to search for or extract data from Windows Event Logs, including queries by specific event IDs. Attackers may use these commands to enumerate events and pull sensitive information such as user activity, session details, or host and IP context. It relies on process creation telemetry, matching command line content for tools and query patterns across wevtutil, wmic, PowerShell cmdlets, and WMI event queries.
references:
- http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
- https://www.group-ib.com/blog/apt41-world-tour-2021/
- https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1
- http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
- https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today
- https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/
- https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2022-09-09
modified: 2025-12-02
tags:
- attack.credential-access
- attack.discovery
- attack.t1552
- attack.t1087
logsource:
category: process_creation
product: windows
detection:
selection_wmi:
CommandLine|contains|all:
- Select
- Win32_NTLogEvent
selection_wevtutil_img:
- Image|endswith: \wevtutil.exe
- OriginalFileName: wevtutil.exe
selection_wevtutil_cli:
CommandLine|contains:
- " qe "
- " query-events "
selection_wmic_img:
- Image|endswith: \wmic.exe
- OriginalFileName: wmic.exe
selection_wmic_cli:
CommandLine|contains: " ntevent"
selection_cmdlet:
CommandLine|contains:
- "Get-WinEvent "
- "get-eventlog "
selection_logs_name:
CommandLine|contains:
- Microsoft-Windows-PowerShell
- Microsoft-Windows-Security-Auditing
- Microsoft-Windows-TerminalServices-LocalSessionManager
- Microsoft-Windows-TerminalServices-RemoteConnectionManager
- Microsoft-Windows-Windows Defender
- PowerShellCore
- Security
- Windows PowerShell
selection_logs_eid:
CommandLine|contains:
- -InstanceId 462?
- .eventid -eq 462?
- .ID -eq 462?
- EventCode=?462?
- EventIdentifier=?462?
- System[EventID=462?]
- -InstanceId 4778
- .eventid -eq 4778
- .ID -eq 4778
- EventCode=?4778?
- EventIdentifier=?4778?
- System[EventID=4778]
- -InstanceId 25
- .eventid -eq 25
- .ID -eq 25
- EventCode=?25?
- EventIdentifier=?25?
- System[EventID=25]
- -InstanceId 1149
- .eventid -eq 1149
- .ID -eq 1149
- EventCode=?1149?
- EventIdentifier=?1149?
- System[EventID=1149]
- -InstanceId 21
- .eventid -eq 21
- .ID -eq 21
- EventCode=?21?
- EventIdentifier=?21?
- System[EventID=21]
- -InstanceId 22
- .eventid -eq 22
- .ID -eq 22
- EventCode=?22?
- EventIdentifier=?22?
- System[EventID=22]
condition: 1 of selection_logs_* and (selection_wmi or all of selection_wevtutil_* or all of selection_wmic_* or selection_cmdlet)
falsepositives:
- Legitimate usage of the utility by administrators to query the event log
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon/info.yml
license: DRL-1.1