Clearing Windows Logs with Wevtutil

Hypothesis and description

In an attempt to clear traces after compromising a machine, threat actors often try to clear Windows Event logs. This is often done using “wevtutil”, a legitimate tool provided by Microsoft. This action interferes with event collection and notification, and may lead to a security event going undetected, thereby potentially leading to further compromise of the network.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-12-02
Contributors: Cyware Labs

ATT&CK coverage

Technique	Tactics	Coverage
T1070 Indicator RemovalT1070.001	Stealth (formerly Defense Evasion)	Low

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1070Indicator Removal
.001 Clear Windows Event Logs

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

process/create/command_line

Pseudocode and implementations

SplunkSplunk search - Detecting log clearing with wevtutilData model: Sysmon native

This search query looks for an instance where wevtutil is invoked along with a command that may cause the system to remove Windows Event logs.

index=__your_sysmon_index__ sourcetype= __your__windows__sysmon__sourcetype EventCode=1 Image=*wevtutil* CommandLine=*cl* (CommandLine=*System* OR CommandLine=*Security* OR CommandLine=*Setup* OR CommandLine=*Application*)

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

4 more in the full list

View CAR-2021-01-003 on car.mitre.org

TTPCAR-2021-01-003