
(CAPA) CAPA_crash_eventlog
Created the . Updated 1 year, 3 months ago.
rule:
meta:
name: crash the Windows event logging service
namespace: anti-analysis/anti-forensic
author: michael.hunhoff@fireeye.com
scope: basic block
att&ck:
- Defense Evasion::Impair Defenses::Disable Windows Event Logging [T1562.002]
references:
- https://github.com/limbenjamin/LogServiceCrash
examples:
- 82BF6347ACF15E5D883715DC289D8A2B:0x14005E0C0
features:
- and:
- count(api(advapi32.ElfClearEventLogFileW)): 3 or more
- count(api(advapi32.OpenEventLogA)): 1 or more
Associated Techniques
Technique Name | Technique ID's | Has Snippet(s) |
---|---|---|
Indicator Removal: Clear Windows Event Logs | T1070.001 U0302 | |
Killing Windows Event Log | U0304 |