splunk-security_content/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Disable Logs Using WevtUtil	Indicator Removal on Host, Clear Windows Event Logs	Endpoint	2021-06-10	true		Indicator Removal on Host Defense Evasion Clear Windows Event Logs Defense Evasion Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections.

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-06-10
• Author: Teoderick Contreras, Splunk
• ID: 236e7c8e-c9d9-11eb-a824-acde48001122

ATT&CK

ID	Technique	Tactic
T1070	Indicator Removal on Host	Defense Evasion

| T1070.001 | Clear Windows Event Logs | Defense Evasion |

Search

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "wevtutil.exe" Processes.process = "*sl*" Processes.process = "*/e:false*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `disable_logs_using_wevtutil_filter`

Associated Analytic Story

• Ransomware

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

• _time
• Processes.parent_process_name
• Processes.parent_process
• Processes.process_name
• Processes.process
• Processes.dest
• Processes.user
• Processes.process_id
• Processes.process_guid

Kill Chain Phase

• Exploitation

Known False Positives

network operator may disable audit event logs for debugging purposes.

RBA

Risk Score	Impact	Confidence	Message
24.0	30	80	WevtUtil.exe used to disable Event Logging on $dest

Reference

• https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log

source | version: 1