mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
37 lines
1.1 KiB
YAML
37 lines
1.1 KiB
YAML
name: Windows Event Log Cleared
|
|
id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a
|
|
version: 4
|
|
date: '2020-07-06'
|
|
description: This search looks for Windows events that indicate one of the Windows
|
|
event logs has been purged.
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
Windows event logs from your hosts.
|
|
type: ESCU
|
|
references: []
|
|
author: Rico Valdez, Splunk
|
|
search: (`wineventlog_security` (EventID=1102 OR EventID=1100)) OR (`wineventlog_system` EventID=104)
|
|
| stats count min(_time) as firstTime max(_time) as lastTime by EventID dest | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`
|
|
known_false_positives: It is possible that these logs may be legitimately cleared
|
|
by Administrators.
|
|
tags:
|
|
analytics_story:
|
|
- Windows Log Manipulation
|
|
- Ransomware
|
|
mitre_attack_id:
|
|
- T1070.001
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 6
|
|
nist:
|
|
- DE.DP
|
|
- PR.IP
|
|
- PR.AC
|
|
- PR.AT
|
|
- DE.AE
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|