Indicator Removal on Host: Clear Windows Event Logs

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.

The event logs can be cleared with the following utility commands:

  • wevtutil cl system
  • wevtutil cl application
  • wevtutil cl security

These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell.

ID: T1070.001
Sub-technique of:  T1070
Tactic: Defense Evasion
Platforms: Windows
System Requirements: Clearing the Windows event logs requires Administrator permissions
Permissions Required: Administrator
Data Sources: API monitoring, File monitoring, Process command-line parameters, Process monitoring
Defense Bypassed: Anti Virus, Host Intrusion Prevention Systems, Log Analysis
Version: 1.0
Created: 28 January 2020
Last Modified: 29 March 2020

Procedure Examples

Name Description

APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.[1][2]


APT32 has cleared select event log entries.[3]


APT38 clears Window Event logs and Sysmon logs from the system.[4]


APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.[5]


The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.[6]

Dragonfly 2.0

Dragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.[7][8]


FIN5 has cleared event logs from victims.[9]


FIN8 has cleared logs during post compromise cleanup activities.[10]


FinFisher clears the system event logs using OpenEventLog/ClearEventLog APIs .[11][12]

gh0st RAT

gh0st RAT is able to wipe event logs.[13][14]


Hydraq creates a backdoor through which remote attackers can clear all system event logs.[15][16]


NotPetya uses wevtutil to clear the Windows event logs.[17]

Olympic Destroyer

Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.[18]


Pupy has a module to clear event logs with PowerShell.[19]


RunningRAT contains code to clear event logs.[20]


SynAck clears event logs.[21]


ZxShell has a command to clear system event logs.[22]


Mitigation Description
Encrypt Sensitive Information

Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.

Remote Data Storage

Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

Restrict File and Directory Permissions

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.


Deleting Windows event logs (via native binaries [23], API functions [24], or PowerShell [25]) may also generate an alterable event (Event ID 1102: "The audit log was cleared").


  1. Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.
  2. Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.
  3. Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.
  4. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018.
  5. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  6. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved May 18, 2016.
  7. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  8. US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
  9. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  10. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  11. FinFisher. (n.d.). Retrieved December 20, 2017.
  12. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  13. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.