Detection rules › Sigma

Potentially Suspicious Call To Win32_NTEventlogFile Class

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: all of selection_class

CommandLine|contains: Win32_NTEventlogFile

Stage 2: all of selection_function

or:
CommandLine|contains: '.BackupEventlog('
CommandLine|contains: '.ChangeSecurityPermissions('
CommandLine|contains: '.ChangeSecurityPermissionsEx('
CommandLine|contains: '.ClearEventLog('
CommandLine|contains: '.Delete('
CommandLine|contains: '.DeleteEx('
CommandLine|contains: '.Rename('
CommandLine|contains: '.TakeOwnerShip('
CommandLine|contains: '.TakeOwnerShipEx('

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • .BackupEventlog(
  • .ChangeSecurityPermissions(
  • .ChangeSecurityPermissionsEx(
  • .ClearEventLog(
  • .Delete(
  • .DeleteEx(
  • .Rename(
  • .TakeOwnerShip(
  • .TakeOwnerShipEx(
  • Win32_NTEventlogFile