Potentially Suspicious EventLog Recon Activity Using Log Query Utilities

detection:
  selection_cmdlet:
    CommandLine|contains:
      - 'Get-WinEvent '
      - 'get-eventlog '
  selection_logs_eid:
    CommandLine|contains:
      - '-InstanceId 462?'
      - '.eventid -eq 462?'
      - '.ID -eq 462?'
      - 'EventCode=?462?'
      - 'EventIdentifier=?462?'
      - 'System[EventID=462?]'
      - '-InstanceId 4778'
      - '.eventid -eq 4778'
      - '.ID -eq 4778'
      - 'EventCode=?4778?'
      - 'EventIdentifier=?4778?'
      - 'System[EventID=4778]'
      - '-InstanceId 25'
      - '.eventid -eq 25'
      - '.ID -eq 25'
      - 'EventCode=?25?'
      - 'EventIdentifier=?25?'
      - 'System[EventID=25]'
      - '-InstanceId 1149'
      - '.eventid -eq 1149'
      - '.ID -eq 1149'
      - 'EventCode=?1149?'
      - 'EventIdentifier=?1149?'
      - 'System[EventID=1149]'
      - '-InstanceId 21'
      - '.eventid -eq 21'
      - '.ID -eq 21'
      - 'EventCode=?21?'
      - 'EventIdentifier=?21?'
      - 'System[EventID=21]'
      - '-InstanceId 22'
      - '.eventid -eq 22'
      - '.ID -eq 22'
      - 'EventCode=?22?'
      - 'EventIdentifier=?22?'
      - 'System[EventID=22]'
  selection_logs_name:
    CommandLine|contains:
      - 'Microsoft-Windows-PowerShell'
      - 'Microsoft-Windows-Security-Auditing'
      - 'Microsoft-Windows-TerminalServices-LocalSessionManager'
      - 'Microsoft-Windows-TerminalServices-RemoteConnectionManager'
      - 'Microsoft-Windows-Windows Defender'
      - 'PowerShellCore'
      - 'Security'
      - 'Windows PowerShell'
  selection_wevtutil_cli:
    CommandLine|contains:
      - ' qe '
      - ' query-events '
  selection_wevtutil_img:
    - Image|endswith: '\wevtutil.exe'
    - OriginalFileName: 'wevtutil.exe'
  selection_wmi:
    CommandLine|contains|all:
      - 'Select'
      - 'Win32_NTLogEvent'
  selection_wmic_cli:
    CommandLine|contains: ' ntevent'
  selection_wmic_img:
    - Image|endswith: '\wmic.exe'
    - OriginalFileName: 'wmic.exe'
  condition: 1 of selection_logs_* and (selection_wmi or all of selection_wevtutil_* or all of selection_wmic_* or selection_cmdlet)

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.