Sigma rule: EventLog Query Requests By Builtin Utilities

Rule

Title

EventLog Query Requests By Builtin Utilities

Status

test

Level

medium

Author

Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)

Date

2023-11-20

Modified

2024-01-24

File

rules-threat-hunting/windows/process_creation/proc_creation_win_susp_event_log_query.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detect attempts to query the contents of the event log using command line utilities. Attackers use this technique in order to look for sensitive information in the logs such as passwords, usernames, IPs, etc.

Log source

product

windows

category

process_creation

Detection

selection_wmi:
    CommandLine|contains|all:
        - 'Select'
        - 'Win32_NTLogEvent'
selection_wevtutil_img:
    - Image|endswith: '\wevtutil.exe'
    - OriginalFileName: 'wevtutil.exe'
selection_wevtutil_cli:
    CommandLine|contains:
        - ' qe '
        - ' query-events '
selection_wmic_img:
    - Image|endswith: '\wmic.exe'
    - OriginalFileName: 'wmic.exe'
selection_wmic_cli:
    CommandLine|contains: ' ntevent'
selection_cmdlet:
    CommandLine|contains:
        - 'Get-WinEvent '
        - 'get-eventlog '
condition: selection_wmi or all of selection_wevtutil_* or all of selection_wmic_* or selection_cmdlet

False positives (as the rule lists them)

• Legitimate log access by administrators or troubleshooting tools

Tags

• attack.t1552
• attack.credential-access
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1552

Related rules

• beaa66d6-aa1b-4e3c-80f5-e0145369bfaf (derived)

References

• https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3
• https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1
• http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_event_log_query.yml