Cross-source coverage

T1685.005 / ATT&CK

Disable or Modify Tools: Clear Windows Event Logs

13 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.

With administrator privileges, the event logs can be cleared with the following utility commands:

  • wevtutil cl system
  • wevtutil cl application
  • wevtutil cl security

These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell. For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the.evtx file between the time the command is run and the reboot.

Adversaries may also attempt to clear logs by directly deleting the stored log files within C:\Windows\System32\winevt\logs\.

Platforms
Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmon

How MITRE says to detect it DET0532

Detection of Event Log Clearing on Windows via Behavioral Chain

Windows Analytic 1472

Detects behavioral sequence where an adversary gains elevated privileges and clears event logs using native binaries (e.g., wevtutil), PowerShell, or direct file deletion of.evtx files.

  • WinEventLog:Security EventCode=1102
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=23

SigmaHQ/sigma

8 rules
Detection Severity Format
NotPetya Ransomware Activity Critical Sigma
Important Windows Eventlog Cleared High Sigma
Security Eventlog Cleared High Sigma
Suspicious Eventlog Clearing or Configuration Change Activity High Sigma
Suspicious Windows Trace ETW Session Tamper Via Logman.EXE High Sigma
Eventlog Cleared Medium Sigma
Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog Medium Sigma
Suspicious Eventlog Clear Medium Sigma

splunk/security_content

5 rules
Detection Severity Format
Disable Logs Using WevtUtil Undefined SPL
Suspicious wevtutil Usage Undefined SPL
Windows Event Log Cleared Undefined SPL
Windows Eventlog Cleared Via Wevtutil Undefined SPL
Windows Event Logging Service Has Shutdown Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.