Clearing Event Log with wevtapi functions #1006
Conversation
|
for example here is it imports only EvtClearLog, not any of the other routines. so here's a VT search for local clearing: https://www.virustotal.com/gui/search/imports%253AEvtClearLog%2520and%2520not%2520imports%253AEvtOpenSession?type=files and likely remote clearing: https://www.virustotal.com/gui/search/imports%253AEvtClearLog%2520and%2520imports%253AEvtOpenSession?type=files (very few hits aside from wevtutil) |
This reverts commit 97b5730.
anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs-remotely.yml
Show resolved
Hide resolved
|
Sorry about all of the mess in the commits, it's my first time writing a CAPA rule and I'm not used to your workflows |
|
no worries! I appreciate the patience. and I'll squash merge so the history ends up clean. really neat that you took the time to submit a rule after developing the POC. i hope we can continue to work together :-) |
Added detection of clearing event logs with functions from wevtapi.dll, these functions can also be used remotely after a session is established with RPC using the EvtOpenSession function.
Reference Code:
getel-arch/ClearLogsRemotely