Skip to content

Commit fe42046

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3489 from splunk/eventlog-stuff
Add New Analytics for Eventlog Enumeration
2 parents 5af5894 + 281f8d2 commit fe42046

3 files changed

+184
-5
lines changed

‎detections/endpoint/suspicious_wevtutil_usage.yml

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Suspicious wevtutil Usage
22
id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f
3-
version: 12
4-
date: '2025-04-16'
3+
version: 13
4+
date: '2025-04-24'
55
author: David Dorsey, Michael Haag, Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -19,9 +19,7 @@ data_source:
1919
- CrowdStrike ProcessRollup2
2020
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
2121
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
22-
where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*",
23-
"* -cl *") Processes.process IN ("*System*", "*Security*", "*Setup*", "*Application*",
24-
"*trace*", "*powershell*") by Processes.action Processes.dest Processes.original_file_name
22+
where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") Processes.process IN ("*System*", "*Security*", "*Setup*", "*Application*", "*trace*", "*powershell*", "Sysmon") by Processes.action Processes.dest Processes.original_file_name
2523
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
2624
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
2725
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash

‎detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Windows Eventlog Cleared Via Wevtutil
2+
id: fdb829a8-db84-4832-b64b-3e964cd44f01
3+
version: 1
4+
date: '2025-04-15'
5+
author: Nasreddine Bencherchali, Splunk
6+
status: production
7+
type: Anomaly
8+
description: |
9+
The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
10+
data_source:
11+
- Sysmon EventID 1
12+
- Windows Event Log Security 4688
13+
- CrowdStrike ProcessRollup2
14+
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
15+
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
16+
where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*")
17+
by Processes.action Processes.dest Processes.original_file_name
18+
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
19+
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
20+
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
21+
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
22+
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
23+
| `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_eventlog_cleared_via_wevtutil_filter`'
24+
how_to_implement: The detection is based on data that originates from Endpoint Detection
25+
and Response (EDR) agents. These agents are designed to provide security-related
26+
telemetry from the endpoints where the agent is installed. To implement this search,
27+
you must ingest logs that contain the process GUID, process name, and parent process.
28+
Additionally, you must ingest complete command-line executions. These logs must
29+
be processed using the appropriate Splunk Technology Add-ons that are specific to
30+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
31+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
32+
names and speed up the data modeling process.
33+
known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs.
34+
references:
35+
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
36+
drilldown_searches:
37+
- name: View the detection results for - "$dest$" and "$user$"
38+
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
39+
earliest_offset: $info_min_time$
40+
latest_offset: $info_max_time$
41+
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
42+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
43+
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
44+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
45+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
46+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
47+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
48+
earliest_offset: $info_min_time$
49+
latest_offset: $info_max_time$
50+
rba:
51+
message: Eventlog was cleared using the Wevtutil.exe utility on $dest$ by $user$
52+
risk_objects:
53+
- field: dest
54+
type: system
55+
score: 28
56+
- field: user
57+
type: user
58+
score: 28
59+
threat_objects: []
60+
tags:
61+
analytic_story:
62+
- Windows Log Manipulation
63+
- Ransomware
64+
- Rhysida Ransomware
65+
- Clop Ransomware
66+
- CISA AA23-347A
67+
- ShrinkLocker
68+
asset_type: Endpoint
69+
mitre_attack_id:
70+
- T1070.001
71+
product:
72+
- Splunk Enterprise
73+
- Splunk Enterprise Security
74+
- Splunk Cloud
75+
security_domain: endpoint
76+
tests:
77+
- name: True Positive Test
78+
attack_data:
79+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/windows_pwh_log_cleared/wevtutil_clear_log.log
80+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
81+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_eventlog_recon_activity_using_log_query_utilities.yml

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
name: Windows EventLog Recon Activity Using Log Query Utilities
2+
id: dc167f8b-3f9d-4460-9c98-8b6e703fd628
3+
version: 1
4+
date: '2025-04-23'
5+
author: Nasreddine Bencherchali, Splunk
6+
status: production
7+
type: Anomaly
8+
description: |
9+
This analytic detects EventLog reconnaissance activity using utilities such as `wevtutil.exe`, `wmic.exe`, PowerShell cmdlets like `Get-WinEvent`, or WMI queries targeting `Win32_NTLogEvent`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. These tools are often used by adversaries to extract usernames, IP addresses, session data, and event information for credential access or situational awareness during lateral movement. While these utilities are legitimate, execution with specific arguments or targeting sensitive logs like `Security`, `PowerShell`, or specific EventIDs (e.g., 4624, 4778) can indicate malicious intent. If confirmed malicious, this behavior could allow an attacker to extract sensitive info and potentially have leveraged access or move laterally.
10+
data_source:
11+
- Sysmon EventID 1
12+
- Windows Event Log Security 4688
13+
- CrowdStrike ProcessRollup2
14+
search: |
15+
| tstats `security_content_summariesonly` values(Processes.process) as process
16+
min(_time) as firstTime max(_time) as lastTime
17+
from datamodel=Endpoint.Processes
18+
where (
19+
(Processes.process_name IN ("powershell.exe", "pwsh.exe", "powershell_ise.exe") AND Processes.process IN ("*Get-WinEvent*", "*Get-EventLog*", "*EventLogQuery*", "*.ReadEvent(*"))
20+
OR
21+
(Processes.process_name=wevtutil.exe Processes.process IN ("* qe *", "* query-events *"))
22+
OR
23+
(Processes.process_name=wmic.exe Processes.process IN ("*ntevent*"))
24+
OR
25+
(Processes.process="*Win32_NTLogEvent*" AND Processes.process="*EventCode*")
26+
OR
27+
(Processes.process IN ("*PsLogList*", "*Eventquery*"))
28+
)
29+
by
30+
Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
31+
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
32+
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
33+
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
34+
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
35+
| `drop_dm_object_name(Processes)`
36+
| `security_content_ctime(firstTime)`
37+
| `security_content_ctime(lastTime)`
38+
| `windows_eventlog_recon_activity_using_log_query_utilities_filter`
39+
how_to_implement: |
40+
The detection is based on data that originates from Endpoint Detection
41+
and Response (EDR) agents. These agents are designed to provide security-related
42+
telemetry from the endpoints where the agent is installed. To implement this search,
43+
you must ingest logs that contain the process GUID, process name, and parent process.
44+
Additionally, you must ingest complete command-line executions. These logs must
45+
be processed using the appropriate Splunk Technology Add-ons that are specific to
46+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
47+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
48+
names and speed up the data modeling process.
49+
known_false_positives: |
50+
System administrators or monitoring tools may legitimately use these utilities to gather logs for troubleshooting or auditing. Filter known admin behavior or monitoring solutions as needed.
51+
references:
52+
- http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
53+
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
54+
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
55+
- https://www.group-ib.com/blog/apt41-world-tour-2021/
56+
- https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf
57+
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent
58+
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog
59+
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
60+
drilldown_searches:
61+
- name: View the detection results for - "$dest$" and "$user$"
62+
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
63+
earliest_offset: $info_min_time$
64+
latest_offset: $info_max_time$
65+
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
66+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
67+
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
68+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
69+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
70+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
71+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
72+
earliest_offset: $info_min_time$
73+
latest_offset: $info_max_time$
74+
rba:
75+
message: Suspicious log query $process$ command was run on $dest$ by $user$
76+
risk_objects:
77+
- field: dest
78+
type: system
79+
score: 30
80+
- field: user
81+
type: user
82+
score: 30
83+
threat_objects: []
84+
tags:
85+
analytic_story:
86+
- Windows Discovery Techniques
87+
asset_type: Endpoint
88+
mitre_attack_id:
89+
- T1654
90+
product:
91+
- Splunk Enterprise
92+
- Splunk Enterprise Security
93+
- Splunk Cloud
94+
security_domain: endpoint
95+
tests:
96+
- name: True Positive Test
97+
attack_data:
98+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1654/eventlog_enumeration/eventlog_enumeration.log
99+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
100+
sourcetype: XmlWinEventLog

0 commit comments

Comments
 (0)