Top Categories


todayMay 10, 2021

Digital Forensics + Malware Analysis Ahmed Elmayyah

Catch the IEX if You Can: PowerShell De-Obfuscation

Introduction A lot of the time when working with malware or when investigating an incident, you may encounter PowerShell executing obfuscated commands which may look like gibberish. These commands are usually obfuscated to make it harder for the analyst to understand, as well as making it harder for detection solutions [...]

Event Log service – Between Offensive and defensive

Digital Forensics Kareem Ali todayOctober 1, 2020 1336

share close

Event Log Service

Event viewer is the preinstalled application in windows to view windows logs, it depends on a event log service to function


EventLog Service

Service configuration:

  • STOPPABLE, AcceptPause, AcceptStop

  • Binary path : svchost.exe -k LocalServiceNetworkRestricted -p

  • ProcessId: 1732



One of the primary anti forensics techniques is clearing logs, and disable logging, attacker can approach this by many methods


Clearing Logs: I just need to say that only security and system logs that have an event for event clear

  •  1102 for clearing security logs
  • 104 for clearing system logs


To Test:

1- run the following command to clear all events

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

2- check what logs have more than 0 log

Get-WinEvent -ListLog *

All methods require administration privileges

Method 1 (Terminate Event log process)

as we say the process responsible for logging events is

svchost -k LocalServiceNetworkRestricted -p -s eventlog

if we suspend this process, the event viewer will be paused, also you will not be able to open new CMD or PowerShell, but you can use the shell you already open.

event viewer will be paused but logs will appear just after resuming the process, the same if you kill the process then start the services again

so if an attacker tried to stop logs like that, you just have to restart the service and everything will be there


  • Live analysis

    • Windows Event Log service is not running (service will be stopped automatically after killing the process )

    • Svchost -k LocalServiceNetworkRestricted -p -s eventlog is not running

  • Sysmon

    • Sysmon exit process doesn’t provide a command line. and monitoring for all svchost process exit will be noisy and not useful as we will not be able to distinguish between svchost processes

  • Killing the Process like this will pause the service of the event log but will not generate 6006 EID


Method 2 (Invoke-Phant0m)

This is PowerShell script that is used to kill thread of the svchost process that responsible for event logging

this technique is good for stopping a lot of security controls not just event viewer


Download: Invoke-Phat0m

Test Environment: Win 10 1909, build 18363.1016

of course any AV will detect Invoke-Phant0m as malware, so as attacker you have to find your way to bypass detection

. ./Invoke-Phant0m

as you see in the above image: Invoke phant0m find the PID for svchost responsible for event logging

and killed its threads and this caused total of 20 events that we will rely on for detection

after killing the threads: No log entries are logged


  • PowerShell Logs (EID 4104 – Script Block log — not enabled by default)

    • manual: it’s very easy to recognize the code for Invoke-Phant0m if no obfuscation occurs

      • but of course attacker can also clear PowerShell logs

    • if we have SIEM then it would

    • Automatic: we will catch any of the strings of the code

      title: Detect Invoke-Phant0m
      id: 1f44f2ab-20bc-7234-93cc-d8ffbc93eadf
      status: experimental
      description: Detects part of the code of Invoke-Phant0m
      date: 2020/09/16
      author: Karem Ali
          - attack.DefenseEvasion
          - attack.T1070.001
          product: windows
          service: powershell
          definition: 'It is recommended to use the new "Script Block Logging" of PowerShell v5 Monitor for EventID 4104'
              EventLog: powershell
              EventID: 4104
                  - "*$ContextRecord.ContextFlags = 0x10003B*"
          condition: selection and keywords 
          - Penetration tests
      level: high
  • Live Analysis

    • Process svchost with command line -k LocalServiceNetworkRestricted -p -s eventlog would have no threads related to eventlog service

Important notice about Invoke-Phant0m that although it will prevent any log from being created but clear logs (1102,104) will be created


Method 3 (Mimikatz event::drop)

Mimikatz is wide used tool for dumping credentials but it also have other usages like stopping the event logging in windows

you can check more details about mimikatz and credential dumping from here Mimikatz


this technique patch the service so it stops logging windows clear event (1102, 104)

Event Log service still logging all other logs.

THE following GIF shows that 1102 is no more generated but logs in PowerShell still be generated, the same as security events ..etc


First of all, if SIEM exists, then clearing logs is not important, we always can find the logs in the SIEM

  • Sysmon

    • Process Access

      • Mimikatz will access svchost

        • correlate PID of svchost with PID of process creation in SIEM if it’s svchost of event log then you know

    • Module Loading (Detect Mimikatz not necessary to be event::drop)
    • bcryptprimitives.dll

    • vaultsvc.dll

    • all DLLs for SSPs like [schannel.dll, credssp.dll, gpapi.dll, wdigest.dll, tspkg.dll, samsrv.dll]

    • If the process loaded all the modules in sysmon then it’s highly likely to be mimikatz, but if only one or two modules then it’s could be a regular process

      •   <Sysmon schemaversion="4.00">
                <ProcessAccess onmatch="include">
                    <TargetImage condition="is">C:\Windows\System32\svchost.exe</TargetImage>
                <ImageLoad onmatch="include"> 
                      <ImageLoaded condition="contains">schannel.dll</ImageLoaded>
                      <ImageLoaded condition="contains">credssp.dll</ImageLoaded>
                      <ImageLoaded condition="contains">gpapi.dll</ImageLoaded>
                      <ImageLoaded condition="contains">wdigest.dll</ImageLoaded>
                      <ImageLoaded condition="contains">tspkg.dll</ImageLoaded>
                      <ImageLoaded condition="contains">samsrv.dll</ImageLoaded>
      • Process Access: x1438 which is


          Which is sufficient access to do the patching

         Patching svchost in on run time on disk, so restarting the service or computer will remove the effect of mimikatz

Written by: Kareem Ali

Rate it

Post comments (0)

Leave a reply

Your email address will not be published. Required fields are marked *

Cyber Castle Footer Logo


Cyber Castle is an Egyptian cyber security company founded in 2020. specializes in the cyber security services & solutions with the aim to detect, protect and mitigate from sophisticated cyber threats in a timely manner.

Where We Are

92 Omar Ibn El-Khattab, Almazah, Heliopolis, Cairo Governorate


Mobile: (02) 01018233755


Follow us