mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
38 lines
1.1 KiB
YAML
38 lines
1.1 KiB
YAML
name: Windows Event Log Cleared
|
|
id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a
|
|
version: 3
|
|
date: '2019-02-27'
|
|
description: This search looks for Windows events that indicate one of the Windows
|
|
event logs has been purged.
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
Windows event logs from your hosts.
|
|
type: ESCU
|
|
references: []
|
|
author: Rico Valdez, Splunk
|
|
search: ((`wineventlog_security` AND (signature_id=1102 OR signature_id=1100)) OR
|
|
((`wineventlog_system` AND signature_id=104) | stats count min(_time) as firstTime
|
|
max(_time) as lastTime by signature_id dest user| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`
|
|
known_false_positives: It is possible that these logs may be legitimately cleared
|
|
by Administrators.
|
|
tags:
|
|
analytics_story:
|
|
- Windows Log Manipulation
|
|
- Ransomware
|
|
mitre_attack_id:
|
|
- T1070
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 6
|
|
nist:
|
|
- DE.DP
|
|
- PR.IP
|
|
- PR.AC
|
|
- PR.AT
|
|
- DE.AE
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|