ID	Name
T1070.001	Clear Windows Event Logs
T1070.002	Clear Linux or Mac System Logs
T1070.003	Clear Command History
T1070.004	File Deletion
T1070.005	Network Share Connection Removal
T1070.006	Timestomp

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.

The event logs can be cleared with the following utility commands:

wevtutil cl system
wevtutil cl application
wevtutil cl security

These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell.

ID: T1070.001

Sub-technique of: T1070

Tactic: Defense Evasion

Platforms: Windows

System Requirements: Clearing the Windows event logs requires Administrator permissions

Permissions Required: Administrator

Data Sources: API monitoring, File monitoring, Process command-line parameters, Process monitoring

Defense Bypassed: Anti Virus, Host Intrusion Prevention Systems, Log Analysis

Version: 1.0

Created: 28 January 2020

Last Modified: 29 March 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
APT28	APT28 has cleared event logs, including by using the commands `wevtutil cl System` and `wevtutil cl Security`.^[1]^[2]
APT32	APT32 has cleared select event log entries.^[3]
APT38	APT38 clears Window Event logs and Sysmon logs from the system.^[4]
APT41	APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.^[5]
BlackEnergy	The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.^[6]
Dragonfly 2.0	Dragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.^[7]^[8]
FIN5	FIN5 has cleared event logs from victims.^[9]
FIN8	FIN8 has cleared logs during post compromise cleanup activities.^[10]
FinFisher	FinFisher clears the system event logs using `OpenEventLog/ClearEventLog APIs` .^[11]^[12]
gh0st RAT	gh0st RAT is able to wipe event logs.^[13]^[14]
Hydraq	Hydraq creates a backdoor through which remote attackers can clear all system event logs.^[15]^[16]
NotPetya	NotPetya uses `wevtutil` to clear the Windows event logs.^[17]
Olympic Destroyer	Olympic Destroyer will attempt to clear the System and Security event logs using `wevtutil`.^[18]
Pupy	Pupy has a module to clear event logs with PowerShell.^[19]
RunningRAT	RunningRAT contains code to clear event logs.^[20]
SynAck	SynAck clears event logs.^[21]
ZxShell	ZxShell has a command to clear system event logs.^[22]

Mitigations

Mitigation	Description
Encrypt Sensitive Information	Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.
Remote Data Storage	Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
Restrict File and Directory Permissions	Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

Detection

Deleting Windows event logs (via native binaries ^[23], API functions ^[24], or PowerShell ^[25]) may also generate an alterable event (Event ID 1102: "The audit log was cleared").

Indicator Removal on Host: Clear Windows Event Logs

Other sub-techniques of Indicator Removal on Host (6)

Procedure Examples

Mitigations

Detection

References