Hackers Exploited Windows Event Logs Tool log Manipulation, And Data Exfiltration

wevtutil.exe, a Windows Event Log management tool, can be abused for LOLBAS attacks. By manipulating its capabilities, attackers can execute arbitrary commands, download malicious payloads, and establish persistence, all while evading traditional security measures.

It is a Windows tool for event log management that can be exploited by attackers to manipulate system logs, potentially concealing malicious activity or compromising system integrity.

By enabling exporting event logs as XML, it clears logs selectively or entirely and queries logs using specific criteria. While essential for system administrators, this tool can be misused by attackers to conceal malicious activity or steal sensitive data.

Free Webinar on Best Practices for API vulnerability & Penetration Testing:  Free Registration

The tool can be abused in post-exploitation scenarios to manipulate event logs, where attackers can leverage this tool to clear, query, or export sensitive log data, hindering incident response efforts and facilitating data exfiltration.

Attackers are exploiting the `wevtutil cl` command to selectively clear specific event logs, such as Application logs, to evade detection and hinder incident response efforts by leveraging a less common utility to bypass traditional security measures focused on more commonly used tools like PowerShell.

In order to resolve the ‘Access Denied’ error and enable the successful clearing of Application logs, it is necessary to elevate user privileges to an administrative level through the command prompt.

wevtutil cannot selectively clear specific events from an event log, only entire logs,  where clearing the security log is less stealthy as it generates Event ID 1102, a security indicator.

Event ID 1102 provides detailed information about log clearing activities, including the user and process involved, making it easily detectable by security tools, reducing its attractiveness to stealthy attackers.

Windows does not natively log events for non-Security log clearing due to the lower priority assigned to these logs compared to the critical Security log, essential for auditing and forensics.

Administrators can implement Audit Policies to monitor log clearing activities by enabling the “Audit Other Object Access Events” policy under “Advanced Audit Policy Configuration” to track changes made to log management settings.

An attacker can use the `wevtutil qe` command to export sensitive event logs in XML format, potentially exfiltrating credentials or internal activity indicators. While requiring elevated privileges, successful execution can compromise sensitive information.

According to Denwp, administrators and users with read access can export logs by accessing specific logs depending on user permissions, with administrators having broader access and standard users often limited to application/system logs.

To mitigate LOLBAS attacks involving wevtutil.exe, organizations should enhance monitoring, enforce strict access controls on event logs, and utilize behavioral analytics to detect anomalous usage patterns and flag suspicious tool combinations like wevtutil.exe, makecab.exe, and certutil.exe.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar