MITRE ATT&CK - Техника Очистка журналов событий Windows

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Indicator Removal: Очистка журналов событий Windows

Other sub-techniques of Indicator Removal (9)

ID	Название
.001	Очистка журналов событий Windows
.002	Очистка системных журналов Linux или Mac
.003	Очистка истории команд
.004	Удаление файлов
.005	Удаление подключений к общим сетевым ресурсам
.006	Изменение временных меток
.007	Очистка истории сетевых соединений и конфигураций
.008	Очистка почтового ящика
.009	Удаление индикаторов компрометации

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. The event logs can be cleared with the following utility commands: * wevtutil cl system * wevtutil cl application * wevtutil cl security These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell.

ID: T1070.001

Относится к технике: T1070

Тактика(-и): Defense Evasion

Платформы: Windows

Источники данных: Command: Command Execution, File: File Deletion, Process: OS API Execution

Версия: 1.1

Дата создания: 28 Jan 2020

Последнее изменение: 20 Apr 2022

Название	Описание
Примеры процедур
Meteor	Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.(Citation: Check Point Meteor Aug 2021)
FIN8	FIN8 has cleared logs during post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
SynAck	SynAck clears event logs.(Citation: SecureList SynAck Doppelgänging May 2018)
NotPetya	NotPetya uses `wevtutil` to clear the Windows event logs.(Citation: Talos Nyetya June 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Wevtutil	Wevtutil can be used to clear system and security event logs from the system.(Citation: Wevtutil Microsoft Documentation)(Citation: Crowdstrike DNC June 2016)
Chimera	Chimera has cleared event logs on compromised hosts.(Citation: NCC Group Chimera January 2021)
APT28	APT28 has cleared event logs, including by using the commands `wevtutil cl System` and `wevtutil cl Security`.(Citation: Crowdstrike DNC June 2016)(Citation: DOJ GRU Indictment Jul 2018)
APT41	APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.(Citation: FireEye APT41 Aug 2019)
Lucifer	Lucifer can clear and remove event logs.(Citation: Unit 42 Lucifer June 2020)
Olympic Destroyer	Olympic Destroyer will attempt to clear the System and Security event logs using `wevtutil`.(Citation: Talos Olympic Destroyer 2018)
Indrik Spider	Indrik Spider has used Cobalt Strike to empty log files.(Citation: Symantec WastedLocker June 2020)
Dragonfly 2.0	Dragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.(Citation: US-CERT TA18-074A)(Citation: US-CERT APT Energy Oct 2017)
APT38	APT38 clears Window Event logs and Sysmon logs from the system.(Citation: FireEye APT38 Oct 2018)
Dragonfly	Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.(Citation: US-CERT TA18-074A)
FinFisher	FinFisher clears the system event logs using `OpenEventLog/ClearEventLog APIs` .(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
ZxShell	ZxShell has a command to clear system event logs.(Citation: Talos ZxShell Oct 2014)
HermeticWizard	HermeticWizard has the ability to use `wevtutil cl system` to clear event logs.(Citation: ESET Hermetic Wizard March 2022)
APT32	APT32 has cleared select event log entries.(Citation: FireEye APT32 May 2017)
KillDisk	KillDisk deletes Application, Security, Setup, and System Windows Event Logs.(Citation: ESEST Black Energy Jan 2016)
FIN5	FIN5 has cleared event logs from victims.(Citation: Mandiant FIN5 GrrCON Oct 2016)
gh0st RAT	gh0st RAT is able to wipe event logs.(Citation: FireEye Hacking Team)(Citation: Gh0stRAT ATT March 2019)
Hydraq	Hydraq creates a backdoor through which remote attackers can clear all system event logs.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
Pupy	Pupy has a module to clear event logs with PowerShell.(Citation: GitHub Pupy)
RunningRAT	RunningRAT contains code to clear event logs.(Citation: McAfee Gold Dragon)
BlackEnergy	The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.(Citation: ESEST Black Energy Jan 2016)
	During Operation Wocao, the threat actors deleted all Windows system and security event logs using `/Q /c wevtutil cl system` and `/Q /c wevtutil cl security`.(Citation: FoxIT Wocao December 2019)
Operation Wocao	Operation Wocao has deleted Windows Event Logs to hinder forensic investigation.(Citation: FoxIT Wocao December 2019)
HermeticWiper	HermeticWiper can overwrite the `C:\Windows\System32\winevt\Logs` file on a targeted system.(Citation: ESET Hermetic Wizard March 2022)

Контрмера	Описание
Контрмеры
Restrict File and Directory Permissions	Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
Remote Data Storage	Use remote security log and sensitive file storage where access can be controlled better to prevent exposure of intrusion detection log data or sensitive information.
Encrypt Sensitive Information	Protect sensitive information with strong encryption.
Indicator Removal on Host Mitigation	Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system. Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities. Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.

Обнаружение

Deleting Windows event logs (via native binaries (Citation: Microsoft wevtutil Oct 2017), API functions (Citation: Microsoft EventLog.Clear), or PowerShell (Citation: Microsoft Clear-EventLog)) may also generate an alterable event (Event ID 1102: "The audit log was cleared").

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.