Indicator Removal: Clear Windows Event Logs

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.

The event logs can be cleared with the following utility commands:

  • wevtutil cl system
  • wevtutil cl application
  • wevtutil cl security

These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell. For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.[1]

ID: T1070.001
Sub-technique of:  T1070
Tactic: Defense Evasion
Platforms: Windows
System Requirements: Clearing the Windows event logs requires Administrator permissions
Defense Bypassed: Anti Virus, Host Intrusion Prevention Systems, Log Analysis
Contributors: Lucas Heiligenstein
Version: 1.3
Created: 28 January 2020
Last Modified: 11 August 2023

Procedure Examples

ID Name Description
G0007 APT28

APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.[2][3]

G0050 APT32

APT32 has cleared select event log entries.[4]

G0082 APT38

APT38 clears Window Event logs and Sysmon logs from the system.[5]

G0096 APT41

APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.[6]

S1068 BlackCat

BlackCat can clear Windows event logs using wevtutil.exe.[7]

S0089 BlackEnergy

The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.[8]

G0114 Chimera

Chimera has cleared event logs on compromised hosts.[9]

G0035 Dragonfly

Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.[10]

G0053 FIN5

FIN5 has cleared event logs from victims.[11]

G0061 FIN8

FIN8 has cleared logs during post compromise cleanup activities.[12]

S0182 FinFisher

FinFisher clears the system event logs using OpenEventLog/ClearEventLog APIs .[13][14]

S0032 gh0st RAT

gh0st RAT is able to wipe event logs.[15][16]

S0697 HermeticWiper

HermeticWiper can overwrite the C:\Windows\System32\winevt\Logs file on a targeted system.[17]

S0698 HermeticWizard

HermeticWizard has the ability to use wevtutil cl system to clear event logs.[17]

S0203 Hydraq

Hydraq creates a backdoor through which remote attackers can clear all system event logs.[18][19]

G0119 Indrik Spider

Indrik Spider has used Cobalt Strike to empty log files.[20]

S0607 KillDisk

KillDisk deletes Application, Security, Setup, and System Windows Event Logs.[8]

S0532 Lucifer

Lucifer can clear and remove event logs.[21]

S1060 Mafalda

Mafalda can delete Windows Event logs by invoking the OpenEventLogW and ClearEventLogW functions.[22]

S0688 Meteor

Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.[23]

S0368 NotPetya

NotPetya uses wevtutil to clear the Windows event logs.[24][25]

S0365 Olympic Destroyer

Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.[26]

C0014 Operation Wocao

During Operation Wocao, the threat actors deleted all Windows system and security event logs using /Q /c wevtutil cl system and /Q /c wevtutil cl security.[27]

S0192 Pupy

Pupy has a module to clear event logs with PowerShell.[28]

S0253 RunningRAT

RunningRAT contains code to clear event logs.[29]

S0242 SynAck

SynAck clears event logs.[30]

S0645 Wevtutil

Wevtutil can be used to clear system and security event logs from the system.[31][2]

S0412 ZxShell

ZxShell has a command to clear system event logs.[32]

Mitigations

ID Mitigation Description
M1041 Encrypt Sensitive Information

Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.

M1029 Remote Data Storage

Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

M1022 Restrict File and Directory Permissions

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments for actions that would delete Windows event logs (via PowerShell) such as Remove-EventLog -LogName Security.

Note: Event ID 4104 (from the Microsoft-Windows-Powershell/Operational log) captures Powershell script blocks, which can be analyzed and used to detect on attempts to Clear Windows Event Logs. In particular, Powershell has a built-in Clear-EventLog cmdlet that allows for a specified log to be cleared.

DS0022 File File Deletion

Monitor for unexpected deletion of Windows event logs (via native binaries) and may also generate an alterable event (Event ID 1102: "The audit log was cleared"). When an eventlog is cleared, a new event is created that alerts that the eventlog was cleared. For Security logs, its event code 1100 and 1102. For System logs, it is event code 104.

It is unlikely that event log data would be cleared during normal operations, and it is likely that malicious attackers may try to cover their tracks by clearing an event log. When an event log gets cleared, it is suspicious.

  1. This is often done using wevtutil, a legitimate tool provided by Microsoft. This action interferes with event collection and notification, and may lead to a security event going undetected, thereby potentially leading to further compromise of the network.

  2. Alerting when a Clear Event Log is generated could point to this intruder technique. Centrally collecting events has the added benefit of making it much harder for attackers to cover their tracks. Event Forwarding permits sources to forward multiple copies of a collected event to multiple collectors, thus enabling redundant event collection. Using a redundant event collection model can minimize the single point of failure risk.

  3. Attackers may set the option of the sources of events with Limit-EventLog -LogName Security -OverflowAction DoNotOverwrite to not delete old Evenlog when the .evtx is full. By default the Security Log size is configured with the minimum value of 20 480KB (~23 000 EventLog). So if this option is enabled, all the new EventLogs will be automatically deleted. We can detect this behavior with the Security EventLog 1104.

  4. Attackers may delete .evtx with del C:\Windows\System32\winevt\logs\Security.evtx or Remove-Item C:\Windows\System32\winevt\logs\Security.evtx after having disabled and stopped the Eventlog service. As the EventLog service is disabled and stopped, the .evtx files are no longer used by this service and can be deleted. The new EventLog will be Unavailable until the configuration is reset.

  5. Attackers may use the powershell command Remove-EventLog -LogName Security to unregister source of events that are part of Windows (Application, Security…). This command deletes the security EventLog (which also generates EventId 1102) but the new Eventlogs are still recorded until the system is rebooted . After the System is rebooted, the Security log is unregistered and doesn’t log any new Eventlog. However logs generated between the command and the reboot are still available in the .evtx file.

Analytic 1 - User Activity from Clearing Event Logs

cleared_logs = filter log_files where ((log_name = "Security") AND (event_id = "1100" OR event_id ="1102" OR event_id = "1104")) OR (log_name = "System" AND event_code = "104")

DS0009 Process OS API Execution

Monitor for Windows API calls that may clear Windows Event Logs to hide the activity of an intrusion.

Process Creation

Monitor for newly executed processes that may clear Windows Event Logs to hide the activity of an intrusion. In an attempt to clear traces after compromising a machine, threat actors often try to clear Windows Event logs. This is often done using "wevtutil", a legitimate tool provided by Microsoft. This action interferes with event collection and notification, and may lead to a security event going undetected, thereby potentially leading to further compromise of the network.

Analytic 1 - Clearing Windows Logs with Wevtutil

cleared_logs = filter processes where (event_id = "1" AND process_name = "wevtutil" AND cmd_line= "cl"

References

  1. Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.
  2. Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.
  3. Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.
  4. Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.
  5. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018.
  6. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  7. Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.
  8. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved May 18, 2016.
  9. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021.
  10. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  11. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  12. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  13. FinFisher. (n.d.). Retrieved December 20, 2017.
  14. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  15. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.
  16. Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.
  1. ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.
  2. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  3. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  4. Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.
  5. Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.
  6. Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.
  7. Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.
  8. Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises Systems Worldwide. Retrieved March 26, 2019.
  9. Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.
  10. Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.
  11. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  12. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  13. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  14. Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  15. Microsoft. (n.d.). wevtutil. Retrieved September 14, 2021.
  16. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.