Add New Analytics for Eventlog Enumeration

detections/endpoint/suspicious_wevtutil_usage.yml

@@ -1,7 +1,7 @@
 name: Suspicious wevtutil Usage
 id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f
-version: 12
-date: '2025-04-16'
+version: 13
+date: '2025-04-24'
 author: David Dorsey, Michael Haag, Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -19,9 +19,7 @@ data_source:
 - CrowdStrike ProcessRollup2
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*",
-  "* -cl *") Processes.process IN ("*System*", "*Security*", "*Setup*", "*Application*",
-  "*trace*", "*powershell*") by Processes.action Processes.dest Processes.original_file_name
+  where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") Processes.process IN ("*System*", "*Security*", "*Setup*", "*Application*", "*trace*", "*powershell*", "Sysmon") by Processes.action Processes.dest Processes.original_file_name
   Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
   Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
   Processes.process Processes.process_exec Processes.process_guid Processes.process_hash

detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml

@@ -0,0 +1,81 @@
+name: Windows Eventlog Cleared Via Wevtutil
+id: fdb829a8-db84-4832-b64b-3e964cd44f01
+version: 1
+date: '2025-04-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: |
+  The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
+data_source:
+- Sysmon EventID 1
+- Windows Event Log Security 4688
+- CrowdStrike ProcessRollup2
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*")
+  by Processes.action Processes.dest Processes.original_file_name
+  Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
+  Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
+  Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
+  Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
+  Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_eventlog_cleared_via_wevtutil_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
+drilldown_searches:
+- name: View the detection results for - "$dest$" and "$user$"
+  search: '%original_detection_search% | search  dest = "$dest$" user = "$user$"'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+- name: View risk events for the last 7 days for - "$dest$" and "$user$"
+  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
+    "$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
+rba:
+  message: Eventlog was cleared using the Wevtutil.exe utility on $dest$ by $user$
+  risk_objects:
+  - field: dest
+    type: system
+    score: 28
+  - field: user
+    type: user
+    score: 28
+  threat_objects: []
+tags:
+  analytic_story:
+  - Windows Log Manipulation
+  - Ransomware
+  - Rhysida Ransomware
+  - Clop Ransomware
+  - CISA AA23-347A
+  - ShrinkLocker
+  asset_type: Endpoint
+  mitre_attack_id:
+  - T1070.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/windows_pwh_log_cleared/wevtutil_clear_log.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: XmlWinEventLog

detections/endpoint/windows_eventlog_recon_activity_using_log_query_utilities.yml

@@ -0,0 +1,100 @@
+name: Windows EventLog Recon Activity Using Log Query Utilities
+id: dc167f8b-3f9d-4460-9c98-8b6e703fd628
+version: 1
+date: '2025-04-23'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: Anomaly
+description: |
+  This analytic detects EventLog reconnaissance activity using utilities such as `wevtutil.exe`, `wmic.exe`, PowerShell cmdlets like `Get-WinEvent`, or WMI queries targeting `Win32_NTLogEvent`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. These tools are often used by adversaries to extract usernames, IP addresses, session data, and event information for credential access or situational awareness during lateral movement. While these utilities are legitimate, execution with specific arguments or targeting sensitive logs like `Security`, `PowerShell`, or specific EventIDs (e.g., 4624, 4778) can indicate malicious intent. If confirmed malicious, this behavior could allow an attacker to extract sensitive info and potentially have leveraged access or move laterally.
+data_source:
+  - Sysmon EventID 1
+  - Windows Event Log Security 4688
+  - CrowdStrike ProcessRollup2
+search: |
+  | tstats `security_content_summariesonly` values(Processes.process) as process
+    min(_time) as firstTime max(_time) as lastTime 
+    from datamodel=Endpoint.Processes 
+    where (
+      (Processes.process_name IN ("powershell.exe", "pwsh.exe", "powershell_ise.exe") AND Processes.process IN ("*Get-WinEvent*", "*Get-EventLog*", "*EventLogQuery*", "*.ReadEvent(*"))
+      OR
+      (Processes.process_name=wevtutil.exe Processes.process IN ("* qe *", "* query-events *"))
+      OR
+      (Processes.process_name=wmic.exe Processes.process IN ("*ntevent*"))
+      OR
+      (Processes.process="*Win32_NTLogEvent*" AND Processes.process="*EventCode*")
+      OR
+      (Processes.process IN ("*PsLogList*", "*Eventquery*"))
+    ) 
+    by 
+      Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
+      Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
+      Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
+      Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
+      Processes.process_path Processes.user Processes.user_id Processes.vendor_product
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_eventlog_recon_activity_using_log_query_utilities_filter`
+how_to_implement: |
+  The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: |
+  System administrators or monitoring tools may legitimately use these utilities to gather logs for troubleshooting or auditing. Filter known admin behavior or monitoring solutions as needed.
+references:
+  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
+  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
+  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
+  - https://www.group-ib.com/blog/apt41-world-tour-2021/
+  - https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf
+  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent
+  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog
+  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
+drilldown_searches:
+  - name: View the detection results for - "$dest$" and "$user$"
+    search: '%original_detection_search% | search  dest = "$dest$" user = "$user$"'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
+  - name: View risk events for the last 7 days for - "$dest$" and "$user$"
+    search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
+      "$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
+      as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
+      Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
+      as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
+      by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
+rba:
+  message: Suspicious log query $process$ command was run on $dest$ by $user$
+  risk_objects:
+    - field: dest
+      type: system
+      score: 30
+    - field: user
+      type: user
+      score: 30
+  threat_objects: []
+tags:
+  analytic_story:
+    - Windows Discovery Techniques
+  asset_type: Endpoint
+  mitre_attack_id:
+    - T1654
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1654/eventlog_enumeration/eventlog_enumeration.log
+        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+        sourcetype: XmlWinEventLog