mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Michael Haag
72 lines
2.5 KiB
YAML
72 lines
2.5 KiB
YAML
name: Windows Event Log Cleared
|
|
id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a
|
|
version: 6
|
|
date: '2020-07-06'
|
|
author: Rico Valdez, Michael Haag, Splunk
|
|
type: TTP
|
|
datamodel: []
|
|
description: The following analytic utilizes Windows Security Event ID 1102 or System
|
|
log event 104 to identify when a Windows event log is cleared. Note that this analytic
|
|
will require tuning or restricted to specific endpoints based on criticality. During
|
|
triage, based on time of day and user, determine if this was planned. If not planned,
|
|
follow through with reviewing parallel alerts and other data sources to determine
|
|
what else may have occurred.
|
|
search: (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104)
|
|
| stats count min(_time) as firstTime max(_time) as lastTime by dest Message EventCode
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
|
|
known_false_positives: It is possible that these logs may be legitimately cleared
|
|
by Administrators. Filter as needed.
|
|
references:
|
|
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102
|
|
- https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads
|
|
- https://attack.mitre.org/techniques/T1070/001/
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
|
|
tags:
|
|
analytic_story:
|
|
- Windows Log Manipulation
|
|
- Ransomware
|
|
- Clop Ransomware
|
|
- CISA AA22-264A
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 6
|
|
confidence: 100
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Defense Evasion
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-system.log
|
|
impact: 70
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: Windows event logs cleared on $dest$ via EventCode $EventCode$
|
|
mitre_attack_id:
|
|
- T1070
|
|
- T1070.001
|
|
nist:
|
|
- DE.DP
|
|
- PR.IP
|
|
- PR.AC
|
|
- PR.AT
|
|
- DE.AE
|
|
observable:
|
|
- name: dest
|
|
type: Endpoint
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- EventCode
|
|
- dest
|
|
risk_score: 70
|
|
security_domain: endpoint
|