CmdID / Techniques / T1685

T1685.005 Disable or Modify Tools: Clear Windows Event Logs

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. MITRE ATT&CK

3 Sigma rules T1685.005 on attack.mitre.org

Part of

MITRE ATT&CK

T1685Disable or Modify Tools

Sigma rules tagged with it

process creation, the highest levels first

criticalNotPetya Ransomware ActivityFlorian Roth (Nextron Systems), Tom Ueltschi · Windows

highSuspicious Eventlog Clearing or Configuration Change ActivityEcco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highSuspicious Windows Trace ETW Session Tamper Via Logman.EXEFlorian Roth (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Clear all of the events from the Application log after saving them to C:\admin\backups\a10306.evtx on the page for wevtutil

wevtutil cl Application /bu:C:\admin\backups\a10306.evtxIdentify

Clear specific event log types from the local computer on the page for Clear-EventLog

Clear-EventLog "Windows PowerShell"Identify

Clear specific multiple log types from the local and remote computers on the page for Clear-EventLog

Clear-EventLog -LogName ODiag, OSession -ComputerName localhost, Server02Identify

Clear all logs on the specified computers then display the event log list on the page for Clear-EventLog

Clear-EventLog -LogName Application, System -ConfirmIdentify

Clear all logs on the specified computers then display the event log list on the page for Clear-EventLog

function clear-all-event-logs ($ComputerName="localhost")
{
$logs = Get-EventLog -ComputerName $ComputerName -List | ForEach-Object {$_.Log}
$logs | ForEach-Object {Clear-EventLog -ComputerName $ComputerName -LogName $_ }
Get-EventLog -ComputerName $ComputerName -List
}

clear-all-event-logs -ComputerName Server01

Identify

Increase the size of an event log on the page for Limit-EventLog

Limit-EventLog -LogName "Windows PowerShell" -MaximumSize 20KBIdentify

Retain an event log for a specified duration on the page for Limit-EventLog

Limit-EventLog -LogName Security -ComputerName "Server01", "Server02" -RetentionDays 7Identify

Change the overflow action of all event logs on the page for Limit-EventLog

$Logs = Get-EventLog -List | foreach {$_.Log}
Limit-EventLog -OverflowAction OverwriteOlder -LogName $Logs
Get-EventLog -List

Identify

Remove an event log from the local computer on the page for Remove-EventLog

Remove-EventLog -LogName "MyLog"Identify

Remove an event log from several computers on the page for Remove-EventLog

Remove-EventLog -LogName "MyLog", "TestLog" -ComputerName "Server01", "Server02", "localhost"Identify

Delete an event source on the page for Remove-EventLog

Remove-EventLog -Source "MyApp"Identify

An example is here when CmdID’s reading of it names T1685.005: a Sigma rule it trips is tagged with it, or its abuse is documented as it.