PowerShell Script Block Logging: Suspicious Windows Event Log Clearing Cmdlets

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script activity that contains event log clearing cmdlets and related .NET clear-log usage patterns, including Clear-EventLog, Clear-WinEvent, Remove-EventLog, and Limit-EventLog. Attackers may clear or limit logs to hinder incident response and forensic investigation after malicious activity. It relies on Script Block Logging telemetry and matches specific text fragments within the recorded script block content.

Reporting behind it

Related detections9 linkedT1685.005 — drag to rearrange

Malicious Security Event Log Disabled via wevtutil

Suspicious Event Log Clearing via Wevtutil (via process_creation)

Suspicious Mass Windows Event Log Clearing via PowerShell (via ps_script)

Malicious Event Log Clear Attempt - Wmi (via process_creation)

Malicious Event Log Clear Attempt - Command (via process_creation)

Malicious Event Log Cleared Using Diagnostics - Via PowerShell (via powershell)

Malicious Clearing of Windows Event Logs (via process_creation)

Suspicious Event Log Clearing via wevtutil During Ransomware Activity

Suspicious Event Log Clearing via Get-WinEvent ClearLog (Qilin)

PowerShell Script Block Logging: Suspicious Windows Event Log Clearing Cmdlets

Pivot detection · T1685.005 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-attempts-to-clear-windows-event-logs-via-clear-eventlog-and-related-c-0f017df3

title: "PowerShell Script Block Logging: Suspicious Windows Event Log Clearing Cmdlets"
id: 67fa10f2-6f21-45f6-b61a-d57245f87c75
related:
  - id: cc36992a-4671-4f21-a91d-6c2b72a2edf5
    type: derived
  - id: 0f017df3-8f5a-414f-ad6b-24aff1128278
    type: derived
status: test
description: This rule flags PowerShell script activity that contains event log clearing cmdlets and related .NET clear-log usage patterns, including Clear-EventLog, Clear-WinEvent, Remove-EventLog, and Limit-EventLog. Attackers may clear or limit logs to hinder incident response and forensic investigation after malicious activity. It relies on Script Block Logging telemetry and matches specific text fragments within the recorded script block content.
references:
  - https://twitter.com/oroneequalsone/status/1568432028361830402
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
  - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
  - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
  - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_
  - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-09-12
modified: 2025-10-06
tags:
  - attack.defense-impairment
  - attack.t1685.005
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    - ScriptBlockText|contains:
        - "Clear-EventLog "
        - "Remove-EventLog "
        - "Limit-EventLog "
        - "Clear-WinEvent "
    - ScriptBlockText|contains|all:
        - Eventing.Reader.EventLogSession
        - ClearLog
    - ScriptBlockText|contains|all:
        - Diagnostics.EventLog
        - Clear
  condition: selection
falsepositives:
  - Rare need to clear logs before doing something. Sometimes used by installers or cleaner scripts. The script should be investigated to determine if it's legitimate
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL