Detection rules › Sigma
Suspicious Use of PsLogList
Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1087 Account Discovery, T1087.001 Account Discovery: Local Account, T1087.002 Account Discovery: Domain Account |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
Stages and Predicates
Stage 1: all of selection_img
or:
Image|endswith: '\psloglist.exe'
Image|endswith: '\psloglist64.exe'
OriginalFileName: psloglist.exe
Stage 2: all of selection_cli_eventlog
or:
CommandLine|contains: ' application'
CommandLine|contains: ' security'
CommandLine|contains: ' system'
Stage 3: all of selection_cli_flags
or:
CommandLine|contains: ' -c'
CommandLine|contains: ' -d'
CommandLine|contains: ' -g'
CommandLine|contains: ' -s'
CommandLine|contains: ' -x'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Image | ends_with |
|
OriginalFileName | eq |
|