Monitoring Unauthorized EVTX File Creation in Non-Standard Locations

This brief addresses the security monitoring of Windows Event Log (.evtx) file creation. Threat actors and adversaries often attempt to manipulate, clear, or exfiltrate security logs to mask malicious activities, hinder incident response, or perform offline analysis of system event data. While logs are traditionally stored within the 'C:\Windows\System32\winevt\Logs' directory, malicious actors may redirect logging output or manually copy log files to obscure locations to facilitate staging before exfiltration or to bypass file integrity monitors that may not be configured to audit non-standard directories. Defenders should differentiate between legitimate administrative backup procedures, system-generated temporary logs, and potentially unauthorized file creation events.

Impact

Successful log tampering or unauthorized access to event data can lead to a complete loss of visibility into post-compromise activity. If an attacker successfully stages or modifies logs, they can hide evidence of initial access, lateral movement, or privilege escalation. This visibility gap significantly increases the dwell time of an adversary and complicates the reconstruction of the attack timeline during a forensic investigation.

Recommendation

Deploy the provided Sigma rule to identify anomalous .evtx file creation events across the environment.

• Ensure that Sysmon or equivalent EDR file-event monitoring is configured to audit file creation events for files ending in ".evtx".
• Baseline common administrative backup tools and authorized software that may legitimately create logs in non-standard locations to reduce noise.
• Investigate any .evtx file creation in user-writable directories (e.g., C:\Users, C:\ProgramData\ except for legitimate system paths) as these are high-probability indicators of unauthorized log manipulation.