Suspicious Clearing of Eventlog (via system)

title: Suspicious Clearing of Eventlog (via system)
id: f688d3d9-884e-5fd5-a4b7-4f36582dbad0
status: stable
description: This rule detects one of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution
references:
    - https://attack.mitre.org/techniques/T1685/005/
    - https://twitter.com/deviouspolack/status/832535435960209408
    - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100
author: Huntrule Team
date: 2026-04-10
tags:
    - attack.defense-impairment
    - attack.t1685.005
    - car.2016-04-002
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 104
        Provider_Name: 'Microsoft-Windows-Eventlog'
    filter_main_covered:
        Channel:
            - 'Microsoft-Windows-PowerShell/Operational'
            - 'Microsoft-Windows-Sysmon/Operational'
            - 'PowerShellCore/Operational'
            - 'Security'
            - 'System'
            - 'Windows PowerShell'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium