Event log export or query via wevtutil or PowerShell cmdlets

Siemphony@siemphonymediumT1654unverified

AN0705 maps Security EventID 4688 onto the process_creation category, which is a Sysmon-shaped vocabulary — this rule is written in Security 4688's own field set (NewProcessName, CommandLine, ParentProcessName), not Sysmon's Image/ParentImage, since the two log sources do not share field names. It matches wevtutil's export-log and query-events subcommands, and PowerShell or pwsh calling Get-WinEvent or Get-EventLog — the two native ways to pull event data described by the analytic. Security 4688 needs Audit Process Creation enabled, and CommandLine additionally needs the separate "Include command line in process creation events" policy; neither is on by default. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0255, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((NewProcessName endswith "\\wevtutil.exe" and (ProcessCommandLine contains "epl" or ProcessCommandLine contains "qe")) or ((NewProcessName endswith "\\powershell.exe" or NewProcessName endswith "\\pwsh.exe") and (ProcessCommandLine contains "Get-WinEvent" or ProcessCommandLine contains "Get-EventLog")))

Splunk · SPL

Run this as a search.

index=* ((NewProcessName="*\\wevtutil.exe" AND (CommandLine="*epl*" OR CommandLine="*qe*")) OR ((NewProcessName="*\\powershell.exe" OR NewProcessName="*\\pwsh.exe") AND (CommandLine="*Get-WinEvent*" OR CommandLine="*Get-EventLog*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(NewProcessName) LIKE "*\\\\wevtutil.exe" AND (TO_LOWER(process.command_line) LIKE "*epl*" OR TO_LOWER(process.command_line) LIKE "*qe*")) OR ((TO_LOWER(NewProcessName) LIKE "*\\\\powershell.exe" OR TO_LOWER(NewProcessName) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*get-winevent*" OR TO_LOWER(process.command_line) LIKE "*get-eventlog*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="NewProcessName" type="pcre2">(?i)\\wevtutil\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(epl|qe)</field>    <description>Event log export or query via wevtutil or PowerShell cmdlets (1/2)</description>    <mitre>      <id>T1654</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="NewProcessName" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(Get-WinEvent|Get-EventLog)</field>    <description>Event log export or query via wevtutil or PowerShell cmdlets (2/2)</description>    <mitre>      <id>T1654</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: network_service_discovery
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 3d1aa938-98f5-448d-9f2c-47fc8e6fefa4

ATT&CKT1654

T1654Log Enumeration

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonnetwork service discovery

network service discoveryAI draft — unreviewed

01 · What this rule detects

AN0705 describes native utilities enumerating or exporting logs — wevtutil.exe or PowerShell's Get-WinEvent/Get-EventLog — especially when run by non-administrative users or correlated with a subsequent export or network transfer. This rule matches the process-creation leg only: wevtutil running an export or query subcommand, or PowerShell/pwsh calling one of the two cmdlets. It cannot see the export-or-transfer correlation AN0705 also wants — Sigma has no cross-event join, so a hit here means "log data was queried or exported," not "log data left the host."

02 · Telemetry you need

The brief maps this analytic onto Security EventID 4688, tagged category: process_creation / product: windows in the brief's own sigmaLogsource. That tag is worth pausing on, because it's the specific thing a reviewer flagged. process_creation/windows is the same logsource tuple this corpus uses for Sysmon-shaped rules elsewhere — Image, CommandLine, ParentImage — but Security 4688 has a different field set: NewProcessName, CommandLine, ParentProcessName. This rule correctly uses the 4688 fields (NewProcessName, not Image) and names that choice in its description, but the logsource block itself carries no discriminator — no service: security qualifier — to signal that to a downstream consumer or a generic pySigma pipeline expecting Image/CommandLine for this exact category. The reviewer's point: naming the vocabulary in prose satisfies AUTHORING.md's intent, but a tool reading only the logsource block, not the description, could still silently fail to map the fields. Security 4688 also needs Audit Process Creation enabled, and CommandLine needs the separate Include command line in process creation events policy — neither on by default.

03 · How the logic works

Two selections under condition: 1 of selection*: selection_wevtutil matches NewProcessName|endswith: '\wevtutil.exe' with CommandLine containing epl (export log) or qe (query events); selection_ps matches NewProcessName ending in powershell.exe or pwsh.exe with CommandLine containing Get-WinEvent or Get-EventLog. Wazuh refuses the rule — it can't express an OR across different fields split into separate selections — and that refusal is recorded honestly rather than reshaped into something Wazuh would accept but mean something narrower.

04 · Common false positives

Both listed false positives are legitimate, deliberate log access: SOC analysts or helpdesk staff running wevtutil qe or Get-WinEvent interactively to triage a specific alert; and a designated Windows Event Forwarding collector or log-shipping host running a scheduled PowerShell script that calls Get-WinEvent to relay events off-box — explicitly flagged as "legitimate there, but this rule fires on every run." Neither claims dominant volume by itself, consistent with level: medium.

05 · Detection maturity

tier_1: . Derived from a MITRE scaffold with no query logic, never run against a log line. The vocabulary-ambiguity concern above is a structural risk in how the rule is tagged, not a measured integration failure — it may never bite, depending on what reads this corpus downstream.
tier_2: means confirming Audit Process Creation and command-line logging are actually enabled where this deploys, then checking whether any consuming pipeline mishandles the field mismatch.
tier_3: ** would correlate the log-access event with a subsequent file export or network transfer, the second half of AN0705 this rule cannot see alone.

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude the known WEF collector hosts and any dedicated log-shipping service account by NewProcessName's parent context or by host identity, since that source is scheduled and predictable rather than something worth alerting on every run. Separately, if this rule feeds a pipeline that assumes process_creation/windows always means Sysmon fields, either add a qualifier the pipeline can key on or confirm downstream tooling actually reads the description before consuming this rule. On evasion: a compiled binary or script calling the .NET EventLogReader API (System.Diagnostics.Eventing.Reader) directly instead of the named cmdlets, or renaming/proxying wevtutil, produces no matching command-line string and bypasses every selector.

Declared by the author

SOC analysts or helpdesk staff running wevtutil qe or Get-WinEvent interactively to triage a specific alert or user-reported incident.
A designated log-shipping or Windows Event Forwarding collector host running a scheduled PowerShell script that calls Get-WinEvent to relay events off-box — legitimate there, but this rule fires on every run.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1654, evaluated against their process_creation events.

Share this rule

/u/siemphony/3d1aa938-98f5-448d-9f2c-47fc8e6fefa4

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Event log export or query via wevtutil or PowerShell cmdlets

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it