Failed WMI NTEventLogFile ClearEventLog attempts (Windows WMI Event 5858)

Alerts on WMI errors (Event 5858) tied to attempted NTEventLogFile ClearEventLog calls on Windows.

FreeReviewedSigma · Medium · v2

Product: windows
Service: wmi
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-07-01
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags failed attempts to clear Windows event logs using the WMI NTEventLogFile ClearEventLog method. It matches error event 5858 in the WMI-Activity operational log where the operation contains the Win32_NTEventlogFile class and the cleareventlog action. Attackers may attempt event-log tampering, and failures often indicate attempts blocked by insufficient privileges or other WMI provider issues. The rule relies on WMI-Activity event telemetry and the presence of the specified class/action strings in the event fields.

Reporting behind it

Related detections9 linkedT1685.005 — drag to rearrange

Suspicious Windows Event Log Clearing via wevtutil (via process_creation)

Malicious USN Change Journal Deletion via Fsutil for Anti-Forensics

Suspicious Windows Event Log Clearing via wevtutil

Suspicious Windows Event Log Cleared via wevtutil during Ransomware Staging (via process_creation)

Suspicious Deletion of Terminal Server Client History via reg by UNC1549

Suspicious Windows Event Log Clearing via process_creation

Malicious Windows Event Log Clearing via wevtutil

Suspicious Event Log Clearing via Renamed Log Utility

Suspicious Event Log Clearing via PowerShell Invoke-Expression

Failed WMI NTEventLogFile ClearEventLog attempts (Windows WMI Event 5858)

Pivot detection · T1685.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

failed-wmi-nteventlogfile-cleareventlog-attempts-on-windows-event-5858-d4f1a2b3

title: Failed WMI NTEventLogFile ClearEventLog attempts (Windows WMI Event 5858)
id: 4bc1aeec-3454-419b-b9f8-446dcc891672
status: test
description: This rule flags failed attempts to clear Windows event logs using the WMI NTEventLogFile ClearEventLog method. It matches error event 5858 in the WMI-Activity operational log where the operation contains the Win32_NTEventlogFile class and the cleareventlog action. Attackers may attempt event-log tampering, and failures often indicate attempts blocked by insufficient privileges or other WMI provider issues. The rule relies on WMI-Activity event telemetry and the presence of the specified class/action strings in the event fields.
references:
  - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/cleareventlog-method-in-class-win32-nteventlogfile
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-07-01
tags:
  - attack.defense-impairment
  - attack.t1685.005
logsource:
  product: windows
  service: wmi
detection:
  selection:
    EventID: 5858
    Operation|contains|all:
      - Win32_NTEventlogFile
      - cleareventlog
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog/info.yml
license: DRL-1.1
related:
  - id: d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL