Clear Windows Event Logs (T1685.005) is a sub-technique of Disable or Modify Tools. Adversaries clear Windows Event Logs to hide the activity of an intrusion. MITRE lists the Defense Impairment tactic and Windows as the platform.
Windows Event Logs record alerts and notifications. MITRE names three system-defined sources, System, Application and Security, and five event types: Error, Warning, Information, Success Audit and Failure Audit.
How attackers use it
With administrator privileges, event logs can be cleared with built-in utilities. MITRE lists these commands:
wevtutil cl systemwevtutil cl applicationwevtutil cl security
Other paths exist. Logs can be cleared in the Event Viewer GUI or through PowerShell. MITRE's example is Remove-EventLog -LogName Security, which deletes the Security event log and, after a reboot, disables future logging. The page notes that events may still be generated and stored in the .evtx file between running the command and the reboot.
Adversaries may also delete the stored log files directly from C:\Windows\System32\winevt\logs\.
The technique page lists many actors and malware that cleared Windows event logs after their activity, including cases where System and Security logs were cleared with wevtutil cl, where Sysmon logs were cleared as well, and where logs were deleted after file wipe activity.
Clearing logs is cleanup. It usually comes after the main activity, so the clearing event itself can be the best clue that something happened.
How to detect it
MITRE's detection strategy describes a behavioral chain: an adversary gains elevated privileges and clears event logs with native binaries such as wevtutil, with PowerShell, or by deleting .evtx files directly.
Watch for:
- Process creation for
wevtutilwith thecloption, and for PowerShell log removal cmdlets. - Deletion or modification of
.evtxfiles in the log folder. - Log clear events. Windows writes Event ID 1102 when the Security log is cleared and Event ID 104 when another log, such as System, is cleared.
- A sudden drop in the record count of a log, or a gap in record numbers.
- A host that goes quiet in your central store after a privileged logon.
The 1102 and 104 events matter because they are written even when the clear succeeds. If they reach a central collector, the clear itself is recorded in a place the adversary cannot reach.
How to reduce the risk
MITRE lists three mitigations.
- Remote Data Storage. Forward events automatically to a log server or data repository, so the adversary cannot find and manipulate the data on the local system. Where possible, keep the delay in reporting short, to avoid long local storage.
- Encrypt Sensitive Information. Obfuscate or encrypt event files locally and in transit, so an adversary gets no feedback.
- Restrict File and Directory Permissions. Protect locally stored event files with proper permissions and authentication, and limit paths to privilege escalation.
If you do only one thing, do the first. Forwarding with a short delay turns log clearing from an erasure into a noisy and recorded act.
Check your own environment
These are read-only checks in an elevated PowerShell or command prompt:
wevtutil gli Security
Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=1102)]]" -MaxEvents 5
Get-WinEvent -LogName System -FilterXPath "*[System[(EventID=104)]]" -MaxEvents 5
The first shows information about the Security log, including its record count. The next two list recent clear events, if any. Errors that say no events were found are a normal result.
Then check:
- Are Security, System and Sysmon logs forwarded to a collector, and how quickly?
- Do you alert on Event ID 1102 and 104 from any host?
- Who has local administrator rights, and could they run
wevtutil? - Are the permissions on the Winevt log folder limited?
- Have you included a "log cleared" step in your incident response runbook, with a way to recover the data from the central copy?
Click through it at your own pace, or open it full screen.
Quick check
Which event IDs record that a Windows log was cleared?
Event ID 1102 for the Security log and Event ID 104 for other logs such as System.
Why is Remote Data Storage the strongest mitigation?
Events forwarded off the host cannot be erased by an adversary who only controls that host, and the clear event itself is recorded centrally.
What does Remove-EventLog -LogName Security do, according to MITRE?
It deletes the Security event log and, after a reboot, disables future logging.
Sources
- MITRE ATT&CK, Clear Windows Event Logs (T1685.005): https://attack.mitre.org/techniques/T1685/005
