Windows Process Activity Clearing or Modifying Event Logs via Wevtutil, PowerShell, or WMI

title: Windows Process Activity Clearing or Modifying Event Logs via Wevtutil, PowerShell, or WMI
id: 2e696ee6-5b97-4d5a-9238-11bcdc754436
status: stable
description: This rule identifies Windows process executions where Event Log data is cleared or its configuration is modified using wevtutil, PowerShell, or WMI. Attackers and malware may use these actions to impair monitoring and defense by reducing or changing available event visibility. The detection relies on process creation telemetry, matching on tool process paths and command-line arguments indicative of clear-log, set-log, or ClearEventLog/clear cmdlets.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
  - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
  - https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee
  - https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/
  - https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc
  - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
  - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_
  - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml
author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2019-09-26
modified: 2026-06-01
tags:
  - attack.defense-impairment
  - attack.t1685.005
  - attack.t1685.001
  - car.2016-04-002
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil_img:
    - Image|endswith: \wevtutil.exe
    - OriginalFileName: wevtutil.exe
  selection_wevtutil_cmd:
    CommandLine|contains:
      - "clear-log "
      - " cl "
      - "set-log "
      - " sl "
      - "lfn:"
  selection_other_ps_img:
    Image|endswith:
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
  selection_other_ps_cmd:
    - CommandLine|contains:
        - "Clear-EventLog "
        - "Remove-EventLog "
        - "Limit-EventLog "
        - "Clear-WinEvent "
    - CommandLine|contains|all:
        - Eventing.Reader.EventLogSession
        - ClearLog
    - CommandLine|contains|all:
        - Diagnostics.EventLog
        - Clear
  selection_other_wmi:
    Image|endswith:
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
      - \wmic.exe
    CommandLine|contains: ClearEventLog
  filter_main_msiexec:
    ParentImage:
      - C:\Windows\SysWOW64\msiexec.exe
      - C:\Windows\System32\msiexec.exe
    CommandLine|contains: " sl "
  condition: ((all of selection_wevtutil_*) or (all of selection_other_ps_*) or selection_other_wmi) and not 1 of filter_main_*
falsepositives:
  - Admin activity
  - Scripts and administrative tools used in the monitored environment
  - Maintenance activity
level: high
license: DRL-1.1
related:
  - id: cc36992a-4671-4f21-a91d-6c2b72a2edf5
    type: derived