Failed WMI NTEventLogFile ClearEventLog attempts (Windows WMI Event 5858)

Alerts on WMI errors (Event 5858) tied to attempted NTEventLogFile ClearEventLog calls on Windows.

FreeReviewedSigma · Medium · v2

Product: windows
Service: wmi
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-07-01
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags failed attempts to clear Windows event logs using the WMI NTEventLogFile ClearEventLog method. It matches error event 5858 in the WMI-Activity operational log where the operation contains the Win32_NTEventlogFile class and the cleareventlog action. Attackers may attempt event-log tampering, and failures often indicate attempts blocked by insufficient privileges or other WMI provider issues. The rule relies on WMI-Activity event telemetry and the presence of the specified class/action strings in the event fields.

Reporting behind it

Related detections9 linkedT1685.005 — drag to rearrange

Malicious Security Event Log Disabled via wevtutil

Suspicious Event Log Clearing via Wevtutil (via process_creation)

Suspicious Mass Windows Event Log Clearing via PowerShell (via ps_script)

Malicious Event Log Clear Attempt - Wmi (via process_creation)

Malicious Event Log Clear Attempt - Command (via process_creation)

Malicious Event Log Cleared Using Diagnostics - Via PowerShell (via powershell)

Malicious Clearing of Windows Event Logs (via process_creation)

Suspicious Event Log Clearing via wevtutil During Ransomware Activity

Suspicious Event Log Clearing via Get-WinEvent ClearLog (Qilin)

Failed WMI NTEventLogFile ClearEventLog attempts (Windows WMI Event 5858)

Pivot detection · T1685.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

failed-wmi-nteventlogfile-cleareventlog-attempts-on-windows-event-5858-d4f1a2b3

title: Failed WMI NTEventLogFile ClearEventLog attempts (Windows WMI Event 5858)
id: 4bc1aeec-3454-419b-b9f8-446dcc891672
status: test
description: This rule flags failed attempts to clear Windows event logs using the WMI NTEventLogFile ClearEventLog method. It matches error event 5858 in the WMI-Activity operational log where the operation contains the Win32_NTEventlogFile class and the cleareventlog action. Attackers may attempt event-log tampering, and failures often indicate attempts blocked by insufficient privileges or other WMI provider issues. The rule relies on WMI-Activity event telemetry and the presence of the specified class/action strings in the event fields.
references:
  - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/cleareventlog-method-in-class-win32-nteventlogfile
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-07-01
tags:
  - attack.defense-impairment
  - attack.t1685.005
logsource:
  product: windows
  service: wmi
detection:
  selection:
    EventID: 5858
    Operation|contains|all:
      - Win32_NTEventlogFile
      - cleareventlog
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog/info.yml
license: DRL-1.1
related:
  - id: d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL