# Field case sensitivity and detection rules not triggering 'clear-eventlog'

**URL:** <https://discuss.elastic.co/t/field-case-sensitivity-and-detection-rules-not-triggering-clear-eventlog/230167>\
**Category:** SIEM\
**Created:** [April 28, 2020, 12:27pm UTC](https://discuss.elastic.co/t/field-case-sensitivity-and-detection-rules-not-triggering-clear-eventlog/230167 "2020-04-28T12:27:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jimmburton](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@jimmburton](https://discuss.elastic.co/u/jimmburton)\
**Post date:** [April 28, 2020, 12:27pm UTC](https://discuss.elastic.co/t/field-case-sensitivity-and-detection-rules-not-triggering-clear-eventlog/230167/1 "2020-04-28T12:27:29Z")

</div>

I have an new on-prem deployment of ELK 7.6.2, and have been working the the SIEM tool and like in another post about not seeing a signal get triggered when clearing logs I had the same issue. I worked through the winlogbeats configuration and installed and deployed sysmon on the windows server I am testing with. After everything and seeing the proper fields get populated, I still could not see the signal get triggered when I ran "powershell.exe clear-eventlog -logname security" on the test system.

The fields that were indexed were:

process.name =\> powershell.exe  
event.action =\> Process Create (rule: ProcessCreate)  
process.args =\> powershell.exe, clear-eventlog, -logname, application

Below is the default detection rule for "Clearing Windows Event Logs":

event.action:"Process Create (rule: ProcessCreate)" and (process.name:"wevtutil.exe" and process.args:"cl") or (process.name:"powershell.exe" and process.args:"Clear-EventLog")

It seems the when the field process.args is queried it is case sensitive, and it would not trigger if I used lower case. I made a duplicate of the default detection rule with the process.args query in lower case, and it of course triggered.

Is there a way to make the query case-insensitive like it would be on a windows system when the command is run? I did see some posts in other areas about this, but I didn't seem to find an answer.

---

<div class="post-metadata">

**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\
**Post date:** [April 29, 2020, 4:36am UTC](https://discuss.elastic.co/t/field-case-sensitivity-and-detection-rules-not-triggering-clear-eventlog/230167/2 "2020-04-29T04:36:28Z")

</div>

Hey there Jim, thanks for the detailed writeup!

In this situation (since the [process.args](https://www.elastic.co/guide/en/ecs/master/ecs-process.html#_process_field_details) field is mapped as a keyword), to catch both permutations the query will need to be updated with an additional OR clause as shown below. There is also the [regex query string](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_regular_expressions) syntax, but in testing I was unable to get it to work for this instance.

```auto
event.action:"Process Create (rule: ProcessCreate)" and
 (process.name:"wevtutil.exe" and process.args:"cl") or
 (process.name:"powershell.exe" and (process.args:"Clear-EventLog" or process.args:"clear-eventlog")

```

While that's not too different from your duplicate rule workaround, ECS also has the `process.command_line.text` field, which will be case-insensitive when queried, and [support for this will field](https://github.com/elastic/beats/pull/18058) will be coming to the sysmon module in a future release.

Hopefully this was able to provide some context -- cheers! 🙂

---

<div class="post-metadata">

**Author:** ![jimmburton](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@jimmburton](https://discuss.elastic.co/u/jimmburton)\
**Post date:** [April 29, 2020, 12:23pm UTC](https://discuss.elastic.co/t/field-case-sensitivity-and-detection-rules-not-triggering-clear-eventlog/230167/3 "2020-04-29T12:23:39Z")

</div>

Hello Garrett, thank you for the explanation. I think for this particular Detection Rule (Clear Logs), I will have to wait for the update for process.command\_line.text support in the sysmon module. Otherwise, I would have to create a query with every permutation of the string "clear-eventlog".

Something to look forward to. 🙂

---

<div class="post-metadata">

**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\
**Post date:** [April 29, 2020, 2:57pm UTC](https://discuss.elastic.co/t/field-case-sensitivity-and-detection-rules-not-triggering-clear-eventlog/230167/4 "2020-04-29T14:57:44Z")

</div>

Hey again Jim,

So I chatted with a few folks on the rules team and the regex query string will indeed work here. Just be aware of possible performance implications.

Something like the below should work in this instance -- just be sure `Lucene` is selected at the right of the query bar:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cb39bcfa99829811250a7651c610c484a22d5046.png)

> event.action:"Process Create (rule: ProcessCreate)" AND ((process.name:wevtutil.exe AND process.args:cl) OR (process.name:powershell.exe AND process.args:/[Cc][Ll][Ee][Aa][Rr]-[Ee][Vv][Ee][Nn][Tt][Ll][Oo][Gg]/))

Best!  
Garrett

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2020, 2:57pm UTC](https://discuss.elastic.co/t/field-case-sensitivity-and-detection-rules-not-triggering-clear-eventlog/230167/5 "2020-05-27T14:57:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.