the wevtutil.exe application is a legitimate windows event log utility. administrators may use it to manage windows event logs.

splunk

Techniques

Sample rules

Windows Eventlog Cleared Via Wevtutil

source: splunk
technicques:

Description

The following analytic detects the usage of wevtutil.exe with the “clear-log” parameter in order to clear the contents of logs. Clearing the event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.

Detection logic


| tstats `security_content_summariesonly`
  count values(Processes.process) as process
        min(_time) as firstTime
        max(_time) as lastTime

FROM datamodel=Endpoint.Processes WHERE

Processes.process_name=wevtutil.exe
Processes.process IN ("* cl *", "*clear-log*")

We exclude the following strings to avoid detection overlap and double coverage since they are already covered by the “Suspicious wevtutil Usage” detection.

NOT Processes.process IN (
    "*/Trace*",
    "*AMSI/Debug*",
    "*Application*",
    "*CiscoSecureEndpoint*",
    "*Microsoft-Windows-BitLocker*",
    "*Microsoft-Windows-Bits*",
    "*Microsoft-Windows-CAPI2*",
    "*Microsoft-Windows-Kernel-File*",
    "*Microsoft-Windows-Kernel-Process*",
    "*Microsoft-Windows-LDAP*",
    "*Microsoft-Windows-PowerShell*",
    "*Microsoft-Windows-Sysmon*",
    "*Microsoft-Windows-TerminalServices-LocalSessionManager*",
    "*Microsoft-Windows-TerminalServices-RemoteConnectionManager*",
    "*Microsoft-Windows-WMI-Activity*",
    "*OpenSSH/*",
    "*PowerShellCore/*",
    "*Security*",
    "*Setup*",
    "*System*",
    "*Windows Firewall With Advanced Security*",
    "*Windows PowerShell*"
)

BY Processes.action Processes.dest Processes.original_file_name
   Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
   Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
   Processes.process Processes.process_exec Processes.process_guid
   Processes.process_hash Processes.process_id Processes.process_integrity_level
   Processes.process_name Processes.process_path Processes.user
   Processes.user_id Processes.vendor_product


| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_eventlog_cleared_via_wevtutil_filter`

Suspicious wevtutil Usage

source: splunk
technicques:

Description

The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

FROM datamodel=Endpoint.Processes WHERE

(
    Processes.process_name="wevtutil.exe"
    OR
    Processes.original_file_name="wevtutil.exe"
)

Processes.process IN ("* cl *", "*clear-log*")
Processes.process IN (
    "*/Trace*",
    "*AMSI/Debug*",
    "*Application*",
    "*CiscoSecureEndpoint*",
    "*Microsoft-Windows-BitLocker*",
    "*Microsoft-Windows-Bits*",
    "*Microsoft-Windows-CAPI2*",
    "*Microsoft-Windows-Kernel-File*",
    "*Microsoft-Windows-Kernel-Process*",
    "*Microsoft-Windows-LDAP*",
    "*Microsoft-Windows-PowerShell*",
    "*Microsoft-Windows-Sysmon*",
    "*Microsoft-Windows-TerminalServices-LocalSessionManager*",
    "*Microsoft-Windows-TerminalServices-RemoteConnectionManager*",
    "*Microsoft-Windows-WMI-Activity*",
    "*OpenSSH/*",
    "*PowerShellCore/*",
    "*Security*",
    "*Setup*",
    "*System*",
    "*Windows Firewall With Advanced Security*",
    "*Windows PowerShell*"
)

BY Processes.action Processes.dest Processes.original_file_name
   Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
   Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
   Processes.process Processes.process_exec Processes.process_guid
   Processes.process_hash Processes.process_id Processes.process_integrity_level
   Processes.process_name Processes.process_path Processes.user
   Processes.user_id Processes.vendor_product


| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `suspicious_wevtutil_usage_filter`