Failed WMI NTEventLogFile ClearEventLog attempts on Windows (Event 5858)

title: Failed WMI NTEventLogFile ClearEventLog attempts on Windows (Event 5858)
id: 4bc1aeec-3454-419b-b9f8-446dcc891672
status: test
description: This rule flags error activity in the WMI-Activity operational log where a WMI operation attempts to clear an event log using the Win32_NTEventlogFile ClearEventLog method but fails. Event ID 5858 indicates WMI encountered an error (such as access denied or provider failure), which may reflect an attacker’s attempt to impair or erase logging without sufficient permissions. It relies on WMI-Activity telemetry for Event 5858 and matches the method/class strings associated with the clear operation.
references:
  - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/cleareventlog-method-in-class-win32-nteventlogfile
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-07-01
tags:
  - attack.defense-impairment
  - attack.t1685.005
logsource:
  product: windows
  service: wmi
detection:
  selection:
    EventID: 5858
    Operation|contains|all:
      - Win32_NTEventlogFile
      - cleareventlog
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog/info.yml
license: DRL-1.1
related:
  - id: d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b
    type: derived