Windows: Process Execution of PsLogList with Event Log Dump/Export Flags
Detects PsLogList executions aimed at Security/Application/System logs with dump/export/clear command-line switches.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-12-18
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creations for PsLogList (psloglist.exe / psloglist64 variants) when the command line includes event log targets (security, application, or system) and uses PsLogList switches associated with dumping/exporting and clearing logs. Such activity matters because it enables attackers to enumerate account-related information and potentially erase event evidence after collection. It relies on Windows process creation telemetry, using image name endings and command-line substring matches to identify the behavior.
Reporting behind it
- research.nccgroup.comhttps://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/
- cybereason.comhttps://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos
- github.comhttps://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Sysinternals/PsLogList
- twitter.comhttps://twitter.com/EricaZelic/status/1614075109827874817
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Process Execution of PsLogList with Event Log Dump/Export Flags"
id: dab76024-413f-4611-9b3e-c4e4fe29c271
status: test
description: This rule flags Windows process creations for PsLogList (psloglist.exe / psloglist64 variants) when the command line includes event log targets (security, application, or system) and uses PsLogList switches associated with dumping/exporting and clearing logs. Such activity matters because it enables attackers to enumerate account-related information and potentially erase event evidence after collection. It relies on Windows process creation telemetry, using image name endings and command-line substring matches to identify the behavior.
references:
- https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/
- https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos
- https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Sysinternals/PsLogList
- https://twitter.com/EricaZelic/status/1614075109827874817
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-18
modified: 2026-06-29
tags:
- attack.discovery
- attack.t1087
- attack.t1087.001
- attack.t1087.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
- OriginalFileName: psloglist.exe
- Image|endswith:
- \psloglist.exe
- \psloglist64.exe
- \psloglist64a.exe
selection_cli_eventlog:
CommandLine|contains:
- " security"
- " application"
- " system"
selection_cli_flags:
CommandLine|contains|windash:
- " -d"
- " -x"
- " -s"
- " -c"
- " -g"
condition: all of selection_*
falsepositives:
- Another tool that uses the command line switches of PsLogList
- Legitimate use of PsLogList by an administrator
level: medium
license: DRL-1.1
related:
- id: aae1243f-d8af-40d8-ab20-33fc6d0c55bc
type: derived