EXPLORE

← Back to Explore

T1070.001

Clear Windows Event Logs

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: * <code>wevtutil cl system</code> * <code>wevtutil cl application</code> * ...

Windows

15

Detections

3

Sources

13

Threat Actors

BY SOURCE

6sigma5splunk_escu4elastic

PROCEDURES (7)

Event Log6 detections

Auto-extracted: 6 detections for event log

General Monitoring3 detections

Auto-extracted: 3 detections for general monitoring

Process Creation Monitoring2 detections

Auto-extracted: 2 detections for process creation monitoring

Powershell1 detections

Auto-extracted: 1 detections for powershell

Ransomware1 detections

Auto-extracted: 1 detections for ransomware

Powershell1 detections

Auto-extracted: 1 detections for powershell

Ransomware1 detections

Auto-extracted: 1 detections for ransomware

THREAT ACTORS (13)

APT28 APT32 APT38 APT41 Aquatic Panda Chimera Dragonfly FIN5 FIN8 HAFNIUM Indrik Spider Play Volt Typhoon

DETECTIONS (15)

Clearing Windows Event Logs

Disable Logs Using WevtUtil

Disable Windows Event and Security Logs Using Built-in Tools

Eventlog Cleared

Important Windows Eventlog Cleared

Security Eventlog Cleared

Sensitive Audit Policy Sub-Category Disabled

Suspicious Eventlog Clear

Suspicious Eventlog Clearing or Configuration Change Activity

Suspicious wevtutil Usage

Suspicious Windows Trace ETW Session Tamper Via Logman.EXE

Windows Event Log Cleared

Windows Event Logging Service Has Shutdown

Windows Event Logs Cleared

Windows Eventlog Cleared Via Wevtutil