Windows Process Activity Clearing or Modifying Event Logs via Wevtutil, PowerShell, or WMI
Flags suspicious Windows process command lines that clear or reconfigure Event Logs using wevtutil, PowerShell, or WMI, with an msiexec exception.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-09-26
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process executions where Event Log data is cleared or its configuration is modified using wevtutil, PowerShell, or WMI. Attackers and malware may use these actions to impair monitoring and defense by reducing or changing available event visibility. The detection relies on process creation telemetry, matching on tool process paths and command-line arguments indicative of clear-log, set-log, or ClearEventLog/clear cmdlets.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
- eqllib.readthedocs.iohttps://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
- gist.github.comhttps://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee
- jdhnet.wordpress.comhttps://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/
- linkedin.comhttps://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc
- stackoverflow.comhttps://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-activity-clearing-or-modifying-event-logs-via-wevtutil-powershel-cc36992a
title: Windows Process Activity Clearing or Modifying Event Logs via Wevtutil, PowerShell, or WMI
id: 2e696ee6-5b97-4d5a-9238-11bcdc754436
status: stable
description: This rule identifies Windows process executions where Event Log data is cleared or its configuration is modified using wevtutil, PowerShell, or WMI. Attackers and malware may use these actions to impair monitoring and defense by reducing or changing available event visibility. The detection relies on process creation telemetry, matching on tool process paths and command-line arguments indicative of clear-log, set-log, or ClearEventLog/clear cmdlets.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
- https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
- https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee
- https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/
- https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc
- https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_
- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml
author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2019-09-26
modified: 2026-06-01
tags:
- attack.defense-impairment
- attack.t1685.005
- attack.t1685.001
- car.2016-04-002
logsource:
category: process_creation
product: windows
detection:
selection_wevtutil_img:
- Image|endswith: \wevtutil.exe
- OriginalFileName: wevtutil.exe
selection_wevtutil_cmd:
CommandLine|contains:
- "clear-log "
- " cl "
- "set-log "
- " sl "
- "lfn:"
selection_other_ps_img:
Image|endswith:
- \powershell.exe
- \powershell_ise.exe
- \pwsh.exe
selection_other_ps_cmd:
- CommandLine|contains:
- "Clear-EventLog "
- "Remove-EventLog "
- "Limit-EventLog "
- "Clear-WinEvent "
- CommandLine|contains|all:
- Eventing.Reader.EventLogSession
- ClearLog
- CommandLine|contains|all:
- Diagnostics.EventLog
- Clear
selection_other_wmi:
Image|endswith:
- \powershell.exe
- \powershell_ise.exe
- \pwsh.exe
- \wmic.exe
CommandLine|contains: ClearEventLog
filter_main_msiexec:
ParentImage:
- C:\Windows\SysWOW64\msiexec.exe
- C:\Windows\System32\msiexec.exe
CommandLine|contains: " sl "
condition: ((all of selection_wevtutil_*) or (all of selection_other_ps_*) or selection_other_wmi) and not 1 of filter_main_*
falsepositives:
- Admin activity
- Scripts and administrative tools used in the monitored environment
- Maintenance activity
level: high
license: DRL-1.1
related:
- id: cc36992a-4671-4f21-a91d-6c2b72a2edf5
type: derived