Applied Cybernetics Group
T1685.005 Clear Windows Event Logs
- Technique
T1685.005- Tactics
- Defense Evasion
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 8
- Elastic, Splunk
- 5
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1685/005
MITRE description
Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: * `wevtutil cl system` * `wevtutil cl application` * `wevtutil cl security` These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command `Remove-EventLog -LogName Security` to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging) Adversaries may also attempt to clear logs by directly deleting the stored log files within `C:\Windows\System32\winevt\logs\`.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-09-21Kaspersky Securelist: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
Detection coverage
SigmaHQ community rules
- NotPetya Ransomware Activity (emerging-threats)
- Security Eventlog Cleared (core)
- Eventlog Cleared (core)
- Important Windows Eventlog Cleared (core)
- Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog (core)
- Suspicious Eventlog Clear (core)
- Suspicious Windows Trace ETW Session Tamper Via Logman.EXE (core)
- Suspicious Eventlog Clearing or Configuration Change Activity (core)
Elastic and Splunk rules
- Disable Logs Using WevtUtil (splunk)
- Suspicious wevtutil Usage (splunk)
- Windows Event Log Cleared (splunk)
- Windows Event Logging Service Has Shutdown (splunk)
- Windows Eventlog Cleared Via Wevtutil (splunk)