PowerShell Script Block Logging: Suspicious Windows Event Log Clearing Cmdlets
Flags PowerShell script blocks that call event log clearing cmdlets or ClearLog to impair Windows log visibility.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-12
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script activity that contains event log clearing cmdlets and related .NET clear-log usage patterns, including Clear-EventLog, Clear-WinEvent, Remove-EventLog, and Limit-EventLog. Attackers may clear or limit logs to hinder incident response and forensic investigation after malicious activity. It relies on Script Block Logging telemetry and matches specific text fragments within the recorded script block content.
Reporting behind it
- twitter.comhttps://twitter.com/oroneequalsone/status/1568432028361830402
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
- eqllib.readthedocs.iohttps://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
- stackoverflow.comhttps://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
powershell-attempts-to-clear-windows-event-logs-via-clear-eventlog-and-related-c-0f017df3
title: "PowerShell Script Block Logging: Suspicious Windows Event Log Clearing Cmdlets"
id: 67fa10f2-6f21-45f6-b61a-d57245f87c75
related:
- id: cc36992a-4671-4f21-a91d-6c2b72a2edf5
type: derived
- id: 0f017df3-8f5a-414f-ad6b-24aff1128278
type: derived
status: test
description: This rule flags PowerShell script activity that contains event log clearing cmdlets and related .NET clear-log usage patterns, including Clear-EventLog, Clear-WinEvent, Remove-EventLog, and Limit-EventLog. Attackers may clear or limit logs to hinder incident response and forensic investigation after malicious activity. It relies on Script Block Logging telemetry and matches specific text fragments within the recorded script block content.
references:
- https://twitter.com/oroneequalsone/status/1568432028361830402
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
- https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
- https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_
- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-09-12
modified: 2025-10-06
tags:
- attack.defense-impairment
- attack.t1685.005
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
- ScriptBlockText|contains:
- "Clear-EventLog "
- "Remove-EventLog "
- "Limit-EventLog "
- "Clear-WinEvent "
- ScriptBlockText|contains|all:
- Eventing.Reader.EventLogSession
- ClearLog
- ScriptBlockText|contains|all:
- Diagnostics.EventLog
- Clear
condition: selection
falsepositives:
- Rare need to clear logs before doing something. Sometimes used by installers or cleaner scripts. The script should be investigated to determine if it's legitimate
level: medium
license: DRL-1.1