LoFP / an unknown bug seems to trigger the windows \"svchost\" process to drop evtx files in the \"c:\windows\temp\" directory in the form \"<log_name\">_<uuid>.evtx\". see https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files

Techniques

• t1562
• t1562.002

Sample rules

EVTX Created In Uncommon Location

• source: sigma
• technicques:
  • t1562
  • t1562.002

Description

Detects the creation of new files with the “.evtx” extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting.

Detection logic

condition: selection and not 1 of filter_main_*
filter_main_baseimage:
  TargetFilename|endswith: \Windows\System32\winevt\Logs\
  TargetFilename|startswith: C:\ProgramData\Microsoft\Windows\Containers\BaseImages\
filter_main_path:
  TargetFilename|startswith: C:\Windows\System32\winevt\Logs\
selection:
  TargetFilename|endswith: .evtx