Anvilogic high experimental spl

Clear Windows Event Logs [splunk-winevent]

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. -- Threat Actor Association: APT29/Nobelium, Cadet Blizzard, Lazarus, Memento Team, Redfly, Vice Society, Volt Typhoon - Software Association: Blackcat/ALPHV, Cring, Lockbit, Lorenz, Ransom Cartel, Rhysida, Trigona - Atomics T1070.001 Test#1 Atomics T1070.001 Test#2 Atomics T1070.001 Test#3

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=1102 
OR "<EventID>1102<" 
OR EventCode=517 
OR "<EventID>517<" 
OR EventCode=104 
OR "<EventID>104<")
| table _time, host, user, signature_id, process_name, process, user, name
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...