{"id":339,"date":"2026-09-13T21:32:03","date_gmt":"2026-09-14T01:32:03","guid":{"rendered":"https:\/\/securebydefault.io\/blog\/?p=339"},"modified":"2026-09-13T21:32:03","modified_gmt":"2026-09-14T01:32:03","slug":"soc130-event-log-cleared-powershell-masquerading","status":"publish","type":"post","link":"https:\/\/securebydefault.io\/blog\/soc130-event-log-cleared-powershell-masquerading\/","title":{"rendered":"LetsDefend SOC130 walkthrough: Event Log Cleared on an Exchange server"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

The Alert That Told Me Nothing (And That’s Exactly Why I Kept Digging)<\/strong><\/p>\n\n\n\n

The Setup<\/strong><\/p>\n\n\n\n

\n\n\n\n

This lab was a fun one because the alert itself barely tells you anything. An Event Log Cleared rule fired on an Exchange server. That’s it. Here’s what showed up in the SIEM:<\/p>\n\n\n\n

\n\n \n
\n SOC130 · Event Log Cleared<\/span>\n ALERT DETAILS<\/span>\n <\/div>\n\n \n
\n\n
\n Event ID<\/span>\n 64<\/span>\n <\/div>\n\n
\n Event Time<\/span>\n 2021-02-21T19:23:10 (+03:00)<\/span>\n <\/div>\n\n
\n Rule<\/span>\n SOC130 – Event Log Cleared<\/span>\n <\/div>\n\n
\n Role<\/span>\n Security Analyst<\/span>\n <\/div>\n\n
\n Alert Type<\/span>\n Malware<\/span>\n <\/div>\n\n
\n Difficulty<\/span>\n Easy<\/span>\n <\/div>\n\n
\n MITRE ATT&CK<\/span>\n T1204<\/span>\n <\/div>\n\n
\n File Hash<\/span>\n 7353f60b1739074eb17c5f4dddefe239<\/span>\n <\/div>\n\n
\n File Name<\/span>\n powershell.exe<\/span>\n <\/div>\n\n
\n File Size<\/span>\n 437.50 KB<\/span>\n <\/div>\n\n
\n Device Action<\/span>\n Allowed<\/span>\n <\/div>\n\n
\n Source Address<\/span>\n 172.16.20.3<\/span>\n <\/div>\n\n
\n Source Hostname<\/span>\n Exchange Server<\/span>\n <\/div>\n\n <\/div>\n<\/div>\n\n\n\n

Before I even touched a log, a few things were already bugging me. It’s an Exchange server, so it’s sitting right on the edge of the network handling mail for everybody. The rule that fired exists for one reason: catching someone trying to erase their tracks. And the process behind it is powershell.exe, which is about as normal as it gets on a Windows box and also, let’s be real, the tool every attacker reaches for these days. None of that screams “compromised” by itself, but it was enough to make me slow down instead of clicking through it.<\/p>\n\n\n\n

Quick Refresher: What ‘Log Cleared’ Actually Looks Like<\/strong><\/p>\n\n\n\n

\n\n\n\n

Before I went hunting through logs, I wanted to know exactly what I was hunting for. There are three Windows event IDs worth knowing here:<\/p>\n\n\n\n