MaxPatrol SIEM

Выявляет инциденты ИБ, ведущие к нарушению киберустойчивости компании

T1070.001: Очистка журналов событий Windows

Злоумышленники могут очищать журналы событий Windows, чтобы скрыть свою активность. В журналах событий Windows регистрируются оповещения и уведомления о событиях, происходящих на компьютере. Существует три системных источника событий: Система, Приложение и Безопасность. Типов событий — пять: Ошибка, Предупреждение, Сведения, Аудит успеха, Аудит отказа.

Пользователь с правами администратора может очистить журналы событий с помощью следующих утилит командной строки:

  • wevtutil cl system
  • wevtutil cl application
  • wevtutil cl security

Для очистки журналов событий могут использоваться и другие механизмы, такие как приложение "Просмотр событий" или PowerShell. Например, с помощью команды PowerShell Remove-EventLog -LogName Security злоумышленники могут удалить журнал событий безопасности и отключить ведение журналов после перезагрузки. Примечание. С момента запуска команды и до перезагрузки компьютера события могут продолжать генерироваться и записываться в файл .evtx.

Злоумышленники могут также попытаться удалить файлы журналов событий, расположенные в каталоге C:\Windows\System32\winevt\logs\.

Какие продукты Positive Technologies покрывают технику

Экспертиза MaxPatrol SIEM

mitre_attck_defense_evasion: PT-CR-41: Windows_Eventlog_cleaning: Очистка журнала событий Windows

Способы обнаружения

IDDS0022Источник и компонент данныхФайл: Удаление файлаОписание

Monitor for unexpected deletion of Windows event logs (via native binaries) and may also generate an alterable event (Event ID 1102: "The audit log was cleared"). When an eventlog is cleared, a new event is created that alerts that the eventlog was cleared. For Security logs, its event code 1100 and 1102. For System logs, it is event code 104.

It is unlikely that event log data would be cleared during normal operations, and it is likely that malicious attackers may try to cover their tracks by clearing an event log. When an event log gets cleared, it is suspicious.

  1. This is often done using wevtutil, a legitimate tool provided by Microsoft. This action interferes with event collection and notification, and may lead to a security event going undetected, thereby potentially leading to further compromise of the network.

  2. Alerting when a Clear Event Log is generated could point to this intruder technique. Centrally collecting events has the added benefit of making it much harder for attackers to cover their tracks. Event Forwarding permits sources to forward multiple copies of a collected event to multiple collectors, thus enabling redundant event collection. Using a redundant event collection model can minimize the single point of failure risk.

  3. Attackers may set the option of the sources of events with Limit-EventLog -LogName Security -OverflowAction DoNotOverwrite to not delete old Evenlog when the .evtx is full. By default the Security Log size is configured with the minimum value of 20 480KB (~23 000 EventLog). So if this option is enabled, all the new EventLogs will be automatically deleted. We can detect this behavior with the Security EventLog 1104.

  4. Attackers may delete .evtx with del C:\Windows\System32\winevt\logs\Security.evtx or Remove-Item C:\Windows\System32\winevt\logs\Security.evtx after having disabled and stopped the Eventlog service. As the EventLog service is disabled and stopped, the .evtx files are no longer used by this service and can be deleted. The new EventLog will be Unavailable until the configuration is reset.

  5. Attackers may use the powershell command Remove-EventLog -LogName Security to unregister source of events that are part of Windows (Application, Security…). This command deletes the security EventLog (which also generates EventId 1102) but the new Eventlogs are still recorded until the system is rebooted . After the System is rebooted, the Security log is unregistered and doesn’t log any new Eventlog. However logs generated between the command and the reboot are still available in the .evtx file.

Analytic 1 - User Activity from Clearing Event Logs

(source="*WinEventLog:Security" EventCode IN (1100, 1102, 1104)) OR (source="*WinEventLog:System" EventCode IN (104))

IDDS0009Источник и компонент данныхПроцесс: Создание процессаОписание

Monitor for newly executed processes that may clear Windows Event Logs to hide the activity of an intrusion. In an attempt to clear traces after compromising a machine, threat actors often try to clear Windows Event logs. This is often done using “wevtutil”, a legitimate tool provided by Microsoft. This action interferes with event collection and notification, and may lead to a security event going undetected, thereby potentially leading to further compromise of the network.

Note: This search query looks for wevtutil, Clear-EventLog, Limit-EventLog, Remove-Item or Remove-EventLog inside a command that may cause the system to remove Windows Event logs.

Analytic 1 - Clearing Windows Logs with Wevtutil

(source="*WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1") OR (source="*WinEventLog:Security" EventCode="4688") (Image=wevtutil CommandLine=cl (CommandLine=System OR CommandLine=Security OR CommandLine=Setup OR CommandLine=Application) OR Clear-EventLog OR Limit-EventLog OR (Remove-Item AND .evtx) OR Remove-EventLog)

IDDS0009Источник и компонент данныхПроцесс: Вызовы API ОСОписание

Monitor for Windows API calls that may clear Windows Event Logs to hide the activity of an intrusion.

IDDS0017Источник и компонент данныхКоманда: Выполнение командОписание

Monitor executed commands and arguments for actions that would delete Windows event logs (via PowerShell) such as Remove-EventLog -LogName Security.

Note: Event ID 4104 (from the Microsoft-Windows-Powershell/Operational log) captures Powershell script blocks, which can be analyzed and used to detect on attempts to Clear Windows Event Logs. In particular, Powershell has a built-in Clear-EventLog cmdlet that allows for a specified log to be cleared.

Меры противодействия

IDM1022НазваниеОграничение разрешений для файлов и каталоговОписание

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

IDM1029НазваниеУдаленное хранение данныхОписание

Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

IDM1041НазваниеШифрование важной информацииОписание

Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.