CmdID / Rules / Windows

EventLog Query Requests By Builtin Utilities

A Sigma rule for process creation on Windows, from SigmaHQ’s threat hunting rules, by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems).

medium 1 ATT&CK technique 3 programs it names 48 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection_cmdlet:
    CommandLine|contains:
      - 'Get-WinEvent '
      - 'get-eventlog '
  selection_wevtutil_cli:
    CommandLine|contains:
      - ' qe '
      - ' query-events '
  selection_wevtutil_img:
    - Image|endswith: '\wevtutil.exe'
    - OriginalFileName: 'wevtutil.exe'
  selection_wmi:
    CommandLine|contains|all:
      - 'Select'
      - 'Win32_NTLogEvent'
  selection_wmic_cli:
    CommandLine|contains: ' ntevent'
  selection_wmic_img:
    - Image|endswith: '\wmic.exe'
    - OriginalFileName: 'wmic.exe'
  condition: selection_wmi or all of selection_wevtutil_* or all of selection_wmic_* or selection_cmdlet

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Display the three most recent events from the Application log in textual format on the page for wevtutil

wevtutil qe Application /c:3 /rd:true /f:textIdentify

Clear all logs on the specified computers then display the event log list on the page for Clear-EventLog

function clear-all-event-logs ($ComputerName="localhost")
{
$logs = Get-EventLog -ComputerName $ComputerName -List | ForEach-Object {$_.Log}
$logs | ForEach-Object {Clear-EventLog -ComputerName $ComputerName -LogName $_ }
Get-EventLog -ComputerName $ComputerName -List
}

clear-all-event-logs -ComputerName Server01

Identify

Convert the PowerShell event log to CSV on the page for ConvertTo-Csv

(Get-Culture).TextInfo.ListSeparator
Get-WinEvent -LogName 'Windows PowerShell' | ConvertTo-Csv -UseCulture -NoTypeInformation

Identify

Create a web page to display PowerShell events on the page for ConvertTo-Html

Get-EventLog -LogName "Windows PowerShell" | ConvertTo-Html | Out-File pslog.htmIdentify

Create a web page to display PowerShell events on the page for ConvertTo-Html

Get-EventLog -Log "Windows PowerShell" | ConvertTo-Html -Property Id, Level, TaskIdentify

Operate on the most recent System events on the page for ForEach-Object

Get-EventLog -LogName System -Newest 1000 |
ForEach-Object -Begin {Get-Date} -Process {
Out-File -FilePath Events.txt -Append -InputObject $_.Message
} -End {Get-Date}

Identify

Get event logs on the local computer on the page for Get-EventLog

Get-EventLog -ListIdentify

Get recent entries from an event log on the local computer on the page for Get-EventLog

Get-EventLog -LogName System -Newest 5Identify

Find all sources for a specific number of entries in an event log on the page for Get-EventLog

$Events = Get-EventLog -LogName System -Newest 1000
$Events | Group-Object -Property Source -NoElement | Sort-Object -Property Count -Descending

Identify

Get error events from a specific event log on the page for Get-EventLog

Get-EventLog -LogName System -EntryType ErrorIdentify

Get events from an event log with an InstanceId and Source value on the page for Get-EventLog

Get-EventLog -LogName System -InstanceId 10016 -Source DCOMIdentify

Get events from multiple computers on the page for Get-EventLog

Get-EventLog -LogName System -ComputerName Server01, Server02, Server03Identify

And 36 more examples on CmdID’s program pages.

Programs and files it names

their pages here

wmic.exewevtutilwevtutil.exe

ATT&CK

the techniques it is tagged with

T1552Unsecured Credentials