Cross-source coverage
T1685.005 / ATT&CK
Disable or Modify Tools: Clear Windows Event Logs
13 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
With administrator privileges, the event logs can be cleared with the following utility commands:
wevtutil cl systemwevtutil cl applicationwevtutil cl security
These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell. For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the.evtx file between the time the command is run and the reboot.
Adversaries may also attempt to clear logs by directly deleting the stored log files within C:\Windows\System32\winevt\logs\.
- Tactics
- Defense Impairment
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmon
How MITRE says to detect it DET0532
Detection of Event Log Clearing on Windows via Behavioral Chain
Windows Analytic 1472
Detects behavioral sequence where an adversary gains elevated privileges and clears event logs using native binaries (e.g., wevtutil), PowerShell, or direct file deletion of.evtx files.
WinEventLog:SecurityEventCode=1102WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=23
SigmaHQ/sigma
8 rules| Detection | Severity | Format |
|---|---|---|
| NotPetya Ransomware Activity | Critical | Sigma |
| Important Windows Eventlog Cleared | High | Sigma |
| Security Eventlog Cleared | High | Sigma |
| Suspicious Eventlog Clearing or Configuration Change Activity | High | Sigma |
| Suspicious Windows Trace ETW Session Tamper Via Logman.EXE | High | Sigma |
| Eventlog Cleared | Medium | Sigma |
| Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog | Medium | Sigma |
| Suspicious Eventlog Clear | Medium | Sigma |
splunk/security_content
5 rules| Detection | Severity | Format |
|---|---|---|
| Disable Logs Using WevtUtil | Undefined | SPL |
| Suspicious wevtutil Usage | Undefined | SPL |
| Windows Event Log Cleared | Undefined | SPL |
| Windows Eventlog Cleared Via Wevtutil | Undefined | SPL |
| Windows Event Logging Service Has Shutdown | Undefined | SPL |