mirror of
https://github.com/keyboardcrunch/sentinelone-queries
synced 2026-06-08 17:07:13 +00:00
keyboardcrunch
19 lines
662 B
YAML
19 lines
662 B
YAML
title: Clear Windows Event Logs
|
|
description: Detects the clearing of EventLogs through wevtutil (concise) as well
|
|
as Clear-EventLog through CommandLine and CommandScript objects.
|
|
author: keyboardcrunch
|
|
date: 10/10/2020
|
|
modified: 05/12/2020
|
|
mitre:
|
|
tactic: Defense Evasion
|
|
technique: T1070
|
|
subtechnique: 001
|
|
operating_system: windows
|
|
query: (TgtProcName = "wevtutil.exe" AND TgtProcCmdLine ContainsCIS "cl ") OR ((SrcProcCmdLine
|
|
ContainsCIS "Clear-EventLog" OR SrcProcCmdScript ContainsCIS "Clear-EventLog") AND
|
|
SrcProcParentName Not In ("WmiPrvSE.exe","PFERemediation.exe","svchost.exe"))
|
|
false_positives:
|
|
- SCOM built-in scripts
|
|
tags: null
|
|
|