← Back to Explore
T1685.005
Clear Windows Event Logs
Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: * `wevtutil cl system` * `wevtutil cl application` * `wevtutil cl security` ...
Windows
6
Detections
1
Sources
14
Threat Actors
BY SOURCE
6sigma
PROCEDURES (4)
General Monitoring3 detections
Auto-extracted: 3 detections for general monitoring
Powershell1 detections
Auto-extracted: 1 detections for powershell
Powershell1 detections
Auto-extracted: 1 detections for powershell
Process Creation Monitoring1 detections
Auto-extracted: 1 detections for process creation monitoring