Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
With administrator privileges, the event logs can be cleared with the following utility commands:
wevtutil cl systemwevtutil cl applicationwevtutil cl securityThese logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell. For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.[1]
Adversaries may also attempt to clear logs by directly deleting the stored log files within C:\Windows\System32\winevt\logs\.
| ID | Name | Description |
|---|---|---|
| S1133 | Apostle |
Apostle will attempt to delete all event logs on a victim machine following file wipe activity.[2] |
| G0007 | APT28 |
APT28 has cleared event logs, including by using the commands |
| G0050 | APT32 | |
| G0082 | APT38 |
APT38 clears Window Event logs and Sysmon logs from the system.[6] |
| G0096 | APT41 |
APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.[7] |
| G0143 | Aquatic Panda |
Aquatic Panda clears Windows Event Logs following activity to evade defenses.[8] |
| S1068 | BlackCat |
BlackCat can clear Windows event logs using |
| S0089 | BlackEnergy |
The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.[10] |
| G0114 | Chimera | |
| G0035 | Dragonfly |
Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.[12] |
| S1159 | DUSTTRAP | |
| G0053 | FIN5 | |
| G0061 | FIN8 |
FIN8 has cleared logs during post compromise cleanup activities.[15] |
| S0182 | FinFisher |
FinFisher clears the system event logs using |
| S0032 | gh0st RAT | |
| S0697 | HermeticWiper |
HermeticWiper can overwrite the |
| S0698 | HermeticWizard |
HermeticWizard has the ability to use |
| S0203 | Hydraq |
Hydraq creates a backdoor through which remote attackers can clear all system event logs.[21][22] |
| G0119 | Indrik Spider |
Indrik Spider has used Cobalt Strike to empty log files.[23] Additionally, Indrik Spider has cleared all event logs using |
| S0607 | KillDisk |
KillDisk deletes Application, Security, Setup, and System Windows Event Logs.[10] |
| S0532 | Lucifer | |
| S1060 | Mafalda |
Mafalda can delete Windows Event logs by invoking the |
| S0688 | Meteor |
Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.[27] |
| S1135 | MultiLayer Wiper |
MultiLayer Wiper removes Windows event logs during execution.[28] |
| S0368 | NotPetya |
NotPetya uses |
| S0365 | Olympic Destroyer |
Olympic Destroyer will attempt to clear the System and Security event logs using |
| C0014 | Operation Wocao |
During Operation Wocao, the threat actors deleted all Windows system and security event logs using |
| G1040 | Play |
Play has used tools to remove log files on targeted systems.[33][34] |
| S0192 | Pupy | |
| S0253 | RunningRAT |
RunningRAT contains code to clear event logs.[36] |
| S0242 | SynAck | |
| G1017 | Volt Typhoon |
Volt Typhoon has selectively cleared Windows Event Logs, system logs, and other technical artifacts to remove evidence of intrusion activity.[38] |
| S0645 | Wevtutil |
Wevtutil can be used to clear system and security event logs from the system.[39][3] |
| S0412 | ZxShell |
| ID | Mitigation | Description |
|---|---|---|
| M1041 | Encrypt Sensitive Information |
Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary. |
| M1029 | Remote Data Storage |
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system. |
| M1022 | Restrict File and Directory Permissions |
Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments for actions that would delete Windows event logs (via PowerShell) such as Note: Event ID 4104 (from the Microsoft-Windows-Powershell/Operational log) captures Powershell script blocks, which can be analyzed and used to detect on attempts to Clear Windows Event Logs. In particular, Powershell has a built-in Clear-EventLog cmdlet that allows for a specified log to be cleared. |
| DS0022 | File | File Deletion |
Monitor for unexpected deletion of Windows event logs (via native binaries) and may also generate an alterable event (Event ID 1102: "The audit log was cleared"). When an eventlog is cleared, a new event is created that alerts that the eventlog was cleared. For Security logs, its event code 1100 and 1102. For System logs, it is event code 104. It is unlikely that event log data would be cleared during normal operations, and it is likely that malicious attackers may try to cover their tracks by clearing an event log. When an event log gets cleared, it is suspicious.
Analytic 1 - User Activity from Clearing Event Logs
|
| DS0009 | Process | OS API Execution |
Monitor for Windows API calls that may clear Windows Event Logs to hide the activity of an intrusion. |
| Process Creation |
Monitor for newly executed processes that may clear Windows Event Logs to hide the activity of an intrusion. In an attempt to clear traces after compromising a machine, threat actors often try to clear Windows Event logs. This is often done using "wevtutil", a legitimate tool provided by Microsoft. This action interferes with event collection and notification, and may lead to a security event going undetected, thereby potentially leading to further compromise of the network. Note: This search query looks for wevtutil, Clear-EventLog, Limit-EventLog, Remove-Item or Remove-EventLog inside a command that may cause the system to remove Windows Event logs. Analytic 1 - Clearing Windows Logs with Wevtutil
|