T1685.005sub-technique of T1685 Disable or Modify Tools
Clear Windows Event Logs
Windows4 pieces on this siteT1685.005 on attack.mitre.org
Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma endpoint pack: seven rules for the Windows techniques that keep working
Shadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.
Hunt: the Security audit log was cleared
Event 1102 is the first record of the new log, so it survives the clearing and names the account that did it. One of the cheapest hunts there is, and worth thirty days rather than seven.
Read
Analyses, case studies, guides, references and interview questions.
Forensic timeline cheat sheet: which clock, whose time zone, and what each timestamp really records
A timeline is only as good as your understanding of what each timestamp means. The artifacts that carry time on Windows, what event each one actually records, the zone it is stored in, and the commands to build and cut a super timeline.
Windows event log cheat sheet: by the question you are asking
Organised by what you are trying to establish rather than by number: who logged on and how, what ran, what persisted, what was tampered with. Every entry says which log, whether it is on by default, and what it does not tell you.
how MITRE says to see it
Detection of Event Log Clearing on Windows via Behavioral Chain
- Detects behavioral sequence where an adversary gains elevated privileges and clears event logs using native binaries (e.g., wevtutil), PowerShell, or direct file deletion of.evtx files.
what reduces it
- M1029 Remote Data Storage. Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
- M1022 Restrict File and Directory Permissions. Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.
- M1041 Encrypt Sensitive Information. Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.