Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Rule Tuning] Clearing Windows Event Logs #392

Closed
Samirbous opened this issue Oct 19, 2020 · 0 comments · Fixed by #393
Closed

[Rule Tuning] Clearing Windows Event Logs #392

Samirbous opened this issue Oct 19, 2020 · 0 comments · Fixed by #393
Assignees
@Samirbous
Labels
OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule v7.11.0

Comments

@Samirbous
Copy link
Contributor

Description

Tuning of this rule by adding pe.original_file_name and also adding wevtutil arg /e:false that can be used to disable tracing (e.g. LockerGoga ransomware disables WMI ETW using this command). Example of KQL:

image

Example Data
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Samirbous Samirbous

Labels
OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule v7.11.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Rule Tuning] Clearing or Disabling Windows Event Logs elastic/detection-rules
1 participant
@Samirbous