new: wmi activity ntEventLogFile ClearEventLog failed attempts

regression_data/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog/d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b.json

@@ -0,0 +1,60 @@
+{
+  "Event": {
+    "#attributes": {
+      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
+    },
+    "System": {
+      "Provider": {
+        "#attributes": {
+          "Name": "Microsoft-Windows-WMI-Activity",
+          "Guid": "1418EF04-B0B4-4623-BF7E-D74AB47BBDAA"
+        }
+      },
+      "EventID": 5858,
+      "Version": 0,
+      "Level": 2,
+      "Task": 0,
+      "Opcode": 0,
+      "Keywords": "0x4000000000000000",
+      "TimeCreated": {
+        "#attributes": {
+          "SystemTime": "2026-07-02T02:05:27.438557Z"
+        }
+      },
+      "EventRecordID": 5314,
+      "Correlation": {
+        "#attributes": {
+          "ActivityID": "8E521E2B-7C26-0001-417F-9C8E267CDB01"
+        }
+      },
+      "Execution": {
+        "#attributes": {
+          "ProcessID": 3092,
+          "ThreadID": 22616
+        }
+      },
+      "Channel": "Microsoft-Windows-WMI-Activity/Operational",
+      "Computer": "swachchhanda",
+      "Security": {
+        "#attributes": {
+          "UserID": "S-1-5-18"
+        }
+      }
+    },
+    "UserData": {
+      "Operation_ClientFailure": {
+        "#attributes": {
+          "xmlns": "http://manifests.microsoft.com/win/2006/windows/WMI"
+        },
+        "Id": "{00000000-0000-0000-0000-000000000000}",
+        "ClientMachine": "SWACHCHHANDA",
+        "User": "swachchhanda\\xodih",
+        "ClientProcessId": 25920,
+        "Component": "Unknown",
+        "Operation": "Start IWbemServices::ExecMethod - ROOT\\CIMV2 : \\\\SWACHCHHANDA\\ROOT\\CIMV2:Win32_NTEventlogFile.Name=\"C:\\\\WINDOWS\\\\System32\\\\Winevt\\\\Logs\\\\System.evtx\"::cleareventlog",
+        "ResultCode": "0x80041003",
+        "PossibleCause": "Unknown"
+      }
+    }
+  }
+}

regression_data/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog/info.yml

@@ -0,0 +1,13 @@
+id: 0de34f11-4181-45a0-9162-a92e5363179a
+description: N/A
+date: 2026-07-02
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+rule_metadata:
+    - id: d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b
+      title: Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog
+regression_tests_info:
+    - name: Positive Detection Test
+      type: evtx
+      provider: Microsoft-Windows-Sysmon
+      match_count: 1
+      path: regression_data/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog/d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b.evtx

rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog.yml

@@ -0,0 +1,31 @@
+title: Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog
+id: d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b
+status: test
+description: |
+    Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method.
+    Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated
+    when the WMI operation encounters an error (e.g. access denied, provider failure).
+    It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues.
+    Successful clearing operations will NOT produce this event; for those, correlate with
+    Security event 1102 or System event 104.
+references:
+    - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/cleareventlog-method-in-class-win32-nteventlogfile
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2026-07-01
+tags:
+    - attack.defense-impairment
+    - attack.t1685.005
+logsource:
+    product: windows
+    service: wmi
+detection:
+    selection:
+        EventID: 5858
+        Operation|contains|all:
+            - 'Win32_NTEventlogFile'
+            - 'cleareventlog'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high
+regression_tests_path: regression_data/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog/info.yml

rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml

@@ -12,7 +12,7 @@ references:
     - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html
 author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
 date: 2017-11-27
-modified: 2026-02-12
+modified: 2026-07-02
 tags:
     - attack.stealth
     - attack.t1036
@@ -73,6 +73,7 @@ detection:
             - '\winlogon.exe'
             - '\winver.exe'
             - '\wlanext.exe'
+            - '\wmic.exe'
             - '\wscript.exe'
             - '\wsl.exe'
             - '\wsmprovhost.exe' # Was seen used by Lazarus Group - https://asec.ahnlab.com/en/39828/