{"id":"65236ec7-ace0-4f0c-82fd-737b04fd4dcb","title":"EVTX Created In Uncommon Location","description":"Detects the creation of new files with the \".evtx\" extension in non-common or non-standard location.\nThis could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within.\nNote that backup software and legitimate administrator might perform similar actions during troubleshooting.\n","author":"D3F7A5105","status":"test","level":"medium","date":"2023-01-02","modified":"2024-03-26","tags":["attack.defense-impairment","attack.t1685.001"],"technique_ids":["T1685.001"],"logsource":{"category":"file_event","product":"windows","definition":"Requirements: The \".evtx\" extension should be monitored via a Sysmon configuration. Example: <TargetFilename condition=\"end with\">.evtx<TargetFilename>"},"falsepositives":["Administrator or backup activity","An unknown bug seems to trigger the Windows \"svchost\" process to drop EVTX files in the \"C:\\Windows\\Temp\" directory in the form \"<log_name\">_<uuid>.evtx\". See https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files"],"references":["https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key"],"source_path":"rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations.yml","source_sha256":"f4e705fed019e380816c2fd9c60158edaf80b11ba14438176b488051ad634298","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: EVTX Created In Uncommon Location\nid: 65236ec7-ace0-4f0c-82fd-737b04fd4dcb\nstatus: test\ndescription: |\n    Detects the creation of new files with the \".evtx\" extension in non-common or non-standard location.\n    This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within.\n    Note that backup software and legitimate administrator might perform similar actions during troubleshooting.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key\nauthor: D3F7A5105\ndate: 2023-01-02\nmodified: 2024-03-26\ntags:\n    - attack.defense-impairment\n    - attack.t1685.001\nlogsource:\n    category: file_event\n    product: windows\n    definition: 'Requirements: The \".evtx\" extension should be monitored via a Sysmon configuration. Example: <TargetFilename condition=\"end with\">.evtx<TargetFilename>'\ndetection:\n    selection:\n        TargetFilename|endswith: '.evtx'\n    filter_main_path:\n        TargetFilename|startswith: 'C:\\Windows\\System32\\winevt\\Logs\\'\n    filter_main_baseimage:\n        TargetFilename|startswith: 'C:\\ProgramData\\Microsoft\\Windows\\Containers\\BaseImages\\'\n        TargetFilename|endswith: '\\Windows\\System32\\winevt\\Logs\\'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Administrator or backup activity\n    - An unknown bug seems to trigger the Windows \"svchost\" process to drop EVTX files in the \"C:\\Windows\\Temp\" directory in the form \"<log_name\">_<uuid>.evtx\". See https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files\nlevel: medium\nregression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"}],"data_path":"data/detection-rules/65236ec7-ace0-4f0c-82fd-737b04fd4dcb.json","kind":"sigma"}