PowerShell attempts to clear Windows Event Logs via Clear-EventLog and related cmdlets

Flags PowerShell script blocks that call event log clearing cmdlets or ClearLog to impair Windows log visibility.

FreeUnreviewedSigmamediumv1

powershell-attempts-to-clear-windows-event-logs-via-clear-eventlog-and-related-c-0f017df3

title: PowerShell attempts to clear Windows Event Logs via Clear-EventLog and related cmdlets
id: 67fa10f2-6f21-45f6-b61a-d57245f87c75
related:
  - id: cc36992a-4671-4f21-a91d-6c2b72a2edf5
    type: derived
  - id: 0f017df3-8f5a-414f-ad6b-24aff1128278
    type: derived
status: test
description: This rule identifies PowerShell script block content that uses known Windows event log clearing cmdlets and .NET methods, including Clear-EventLog, Clear-WinEvent, Remove-EventLog, and Limit-EventLog. Event log clearing and suppression are common defense-impairment behaviors used to reduce forensic visibility. Telemetry is based on PowerShell Script Block Logging capturing the relevant cmdlet names and associated .NET types within the same script content.
references:
  - https://twitter.com/oroneequalsone/status/1568432028361830402
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
  - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
  - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
  - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_
  - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-09-12
modified: 2025-10-06
tags:
  - attack.defense-impairment
  - attack.t1685.005
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    - ScriptBlockText|contains:
        - "Clear-EventLog "
        - "Remove-EventLog "
        - "Limit-EventLog "
        - "Clear-WinEvent "
    - ScriptBlockText|contains|all:
        - Eventing.Reader.EventLogSession
        - ClearLog
    - ScriptBlockText|contains|all:
        - Diagnostics.EventLog
        - Clear
  condition: selection
falsepositives:
  - Rare need to clear logs before doing something. Sometimes used by installers or cleaner scripts. The script should be investigated to determine if it's legitimate
level: medium
license: DRL-1.1

What it detects

This rule identifies PowerShell script block content that uses known Windows event log clearing cmdlets and .NET methods, including Clear-EventLog, Clear-WinEvent, Remove-EventLog, and Limit-EventLog. Event log clearing and suppression are common defense-impairment behaviors used to reduce forensic visibility. Telemetry is based on PowerShell Script Block Logging capturing the relevant cmdlet names and associated .NET types within the same script content.

Known false positives

Rare need to clear logs before doing something. Sometimes used by installers or cleaner scripts. The script should be investigated to determine if it's legitimate

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.