Browse Rules

[WINDOWS-SYSMON] Windows Event Log Cleared

[WINDOWS-SYSMON] Windows Event Log Cleared

Windows Event Log Cleared

Detects the clearing of event logs within the Windows Event Viewer.

[WINDOWS-MISC] Unable to log events to security log

[WINDOWS-MISC] Unable to log events to security log

[WINDOWS-MISC] Unable to log events to security log

[WINDOWS-MISC] Unable to log events to security log

[WINDOWS-MISC] Event log has been cleared.

[WINDOWS-MISC] Event log has been cleared.

[WINDOWS-MISC] Event log has been cleared.

[WINDOWS-MISC] Event log has been cleared.

[WINDOWS-MISC] Suspicious event logging service shutdown.

[WINDOWS-MISC] Suspicious event logging service shutdown.

[WINDOWS-MISC] Windows audit log was cleared

[WINDOWS-MISC] Windows audit log was cleared

Disable Windows Event Logging Via Registry

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Disable Windows Event Logging Via Registry

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Disable Windows Event Logging Via Registry

Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel

Windows Event Logs Cleared

Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.

The Event log service was started

The Event log service was started

The Event log service was started

The Event log service was started

[WINDOWS-SECURITY] Special Groups Logon table modified

[WINDOWS-SECURITY] Special Groups Logon table modified

[WINDOWS-AUTH] RDP maximum allowed failed logon attempts

[WINDOWS-AUTH] RDP maximum allowed failed logon attempts

[WINDOWS-AUTH] RDP maximum allowed failed logon attempts

[WINDOWS-AUTH] RDP maximum allowed failed logon attempts

Windows Event Log Cleared

The following analytic detects the clearing of Windows event logs by identifying Windows Security Event ID 1102 or System log event 104. This detection leverages Windows event logs to monitor for log clearing activities. Such behavior is significant as it may indicate an attempt to cover tracks after malicious activities. If confirmed malicious, this action could hinder forensic investigations and allow attackers to persist undetected, making it crucial to investigate further and correlate with

Event Logs Queried for RDP Sessions [splunk-winevent]

Threat actors may query Windows Terminal Services logs for RDP session information. - Example 1: During post-compromise reconnaissance activities, Lazarus was observed using wevtutil to query Windows Terminal Services logs for RDP sessions (Event Code 25) in order to gather session reconnection information. - Example 2: Threat actor tracked as Cluster Charlie (STAC1305) searched Windows Event Logs for Windows Remote Connection Manager event ID 1149 -- This use case detects commands querying Term

Logon Script Registry Key added [splunk-winevent]

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.

Clear Windows Event Logs [splunk-winevent]

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. -- Threat Actor Association: APT29/Nobelium, Cadet Blizzard, Lazarus, Memento Team, Redfly, Vice Society, Volt Typhoon - Software Association: Blackcat/ALPHV, Cring, Lockbit, L

Security Event Logging Disabled via MiniNt Registry Key - Registry Set

Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.

Security Event Logging Disabled via MiniNt Registry Key - Registry Set

Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.

Security Event Logging Disabled via MiniNt Registry Key - Registry Set

Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.

Windows Security Event Logs Queried [snowflake-crowdstrikefdr_process]

wevtutil.exe is a Windows component used to retrieve information about event logs and publishers. Threat actors such as Mustang Panda have been observed using wevtutil to query Windows event logs to gather information about usernames. This use case detects executions with command line patterns indicating attempts to query Windows Event logs. wevtutil has not been included in detection logic to account for instances where it has been renamed. -- Threat Actor Association: Mustang Panda/Stately Tau