1200KM / tool
Wevtutil — Attack Tool
Wevtutil is a Windows command-line utility that enables administrators to retrieve information about event logs and publishers.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: Wevtutil
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- APT28 · G0007 · Pinned relationship source (relationship--0e8f455a-5773-483a-8636-045774732bef)
- Mustang Panda · G0129 · Pinned relationship source (relationship--91c0aeed-d3f8-430a-8443-ff2ae2fa2524)
- Aquatic Panda · G0143 · Pinned relationship source (relationship--120d84d1-e769-421d-8743-645b024d292b)
- Volt Typhoon · G1017 · Pinned relationship source (relationship--30a53a55-718d-4108-9063-45dc9bfacc93)
- Play · G1040 · Pinned relationship source (relationship--867ca425-de4a-4bab-b7a3-5de71cf95c7e)
- MirrorFace · G1054 · Pinned relationship source (relationship--e3888f07-1a1a-442a-8492-ff3c807df9f6)
- The Gentlemen · G1058 · Pinned relationship source (relationship--4d0084c8-b0e9-48f2-9e8e-b7aadbdf4788)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.