{"id":"cc36992a-4671-4f21-a91d-6c2b72a2edf5","title":"Suspicious Eventlog Clearing or Configuration Change Activity","description":"Detects the clearing or configuration tampering of EventLog using utilities such as \"wevtutil\", \"powershell\" and \"wmic\".\nThis technique were seen used by threat actors and ransomware strains in order to evade defenses.\n","author":"Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"stable","level":"high","date":"2019-09-26","modified":"2026-06-01","tags":["attack.defense-impairment","attack.t1685.005","attack.t1685.001","car.2016-04-002"],"technique_ids":["T1685.001","T1685.005"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Admin activity","Scripts and administrative tools used in the monitored environment","Maintenance activity"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md","https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil","https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee","https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/","https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc","https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7","https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_","https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml","source_sha256":"8e7219c92a73b60128a7192521879f97407d37c12a1c567a6975247340cb5624","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Eventlog Clearing or Configuration Change Activity\nid: cc36992a-4671-4f21-a91d-6c2b72a2edf5\nstatus: stable\ndescription: |\n    Detects the clearing or configuration tampering of EventLog using utilities such as \"wevtutil\", \"powershell\" and \"wmic\".\n    This technique were seen used by threat actors and ransomware strains in order to evade defenses.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md\n    - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil\n    - https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee\n    - https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/\n    - https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc\n    - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7\n    - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_\n    - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear\nauthor: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2019-09-26\nmodified: 2026-06-01\ntags:\n    - attack.defense-impairment\n    - attack.t1685.005\n    - attack.t1685.001\n    - car.2016-04-002\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_wevtutil_img:\n        - Image|endswith: '\\wevtutil.exe'\n        - OriginalFileName: 'wevtutil.exe'\n    selection_wevtutil_cmd:\n        CommandLine|contains:\n            - 'clear-log '          # clears specified log\n            - ' cl '                # short version of 'clear-log'\n            - 'set-log '            # modifies config of specified log. could be used to set it to a tiny size\n            - ' sl '                # short version of 'set-log'\n            - 'lfn:'                # change log file location and name\n    selection_other_ps_img:\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\powershell_ise.exe'\n            - '\\pwsh.exe'\n    selection_other_ps_cmd:\n        - CommandLine|contains:\n              - 'Clear-EventLog '\n              - 'Remove-EventLog '\n              - 'Limit-EventLog '\n              - 'Clear-WinEvent '\n        - CommandLine|contains|all:\n              - 'Eventing.Reader.EventLogSession' # [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($_.LogName)\n              - 'ClearLog'\n        - CommandLine|contains|all:\n              - 'Diagnostics.EventLog'\n              - 'Clear'\n    selection_other_wmi:\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\powershell_ise.exe'\n            - '\\pwsh.exe'\n            - '\\wmic.exe'\n        CommandLine|contains: 'ClearEventLog'\n    filter_main_msiexec:\n        # Example seen during office update/installation:\n        #   ParentImage: C:\\Windows\\SysWOW64\\msiexec.exe\n        #   CommandLine: \"C:\\WINDOWS\\system32\\wevtutil.exe\" sl Microsoft-RMS-MSIPC/Debug /q:true /e:true /l:4 /rt:false\n        ParentImage:\n            - 'C:\\Windows\\SysWOW64\\msiexec.exe'\n            - 'C:\\Windows\\System32\\msiexec.exe'\n        CommandLine|contains: ' sl '\n    condition: ((all of selection_wevtutil_*) or (all of selection_other_ps_*) or selection_other_wmi) and not 1 of filter_main_*\nfalsepositives:\n    - Admin activity\n    - Scripts and administrative tools used in the monitored environment\n    - Maintenance activity\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"},{"key":"enterprise/T1685.005","id":"T1685.005","name":"Clear Windows Event Logs","page":"techniques/enterprise/T1685.005/"}],"data_path":"data/detection-rules/cc36992a-4671-4f21-a91d-6c2b72a2edf5.json","kind":"sigma"}