1. Home
  2. ATT&CK Techniques
  3. T1070.001 Clear Windows Event Logs

T1070.001 Clear Windows Event Logs Mappings

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.

The event logs can be cleared with the following utility commands:

  • <code>wevtutil cl system</code>
  • <code>wevtutil cl application</code>
  • <code>wevtutil cl security</code>

These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell. For example, adversaries may use the PowerShell command <code>Remove-EventLog -LogName Security</code> to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging)

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-16 Security and Privacy Attributes Protects T1070.001 Clear Windows Event Logs
AC-17 Remote Access Protects T1070.001 Clear Windows Event Logs
AC-18 Wireless Access Protects T1070.001 Clear Windows Event Logs
AC-19 Access Control for Mobile Devices Protects T1070.001 Clear Windows Event Logs
AC-02 Account Management Protects T1070.001 Clear Windows Event Logs
AC-03 Access Enforcement Protects T1070.001 Clear Windows Event Logs
AC-05 Separation of Duties Protects T1070.001 Clear Windows Event Logs
AC-06 Least Privilege Protects T1070.001 Clear Windows Event Logs
CA-07 Continuous Monitoring Protects T1070.001 Clear Windows Event Logs
CM-02 Baseline Configuration Protects T1070.001 Clear Windows Event Logs
CM-06 Configuration Settings Protects T1070.001 Clear Windows Event Logs
CP-06 Alternate Storage Site Protects T1070.001 Clear Windows Event Logs
CP-07 Alternate Processing Site Protects T1070.001 Clear Windows Event Logs
CP-09 System Backup Protects T1070.001 Clear Windows Event Logs
SC-36 Distributed Processing and Storage Protects T1070.001 Clear Windows Event Logs
SC-04 Information in Shared System Resources Protects T1070.001 Clear Windows Event Logs
SI-12 Information Management and Retention Protects T1070.001 Clear Windows Event Logs
SI-23 Information Fragmentation Protects T1070.001 Clear Windows Event Logs
SI-03 Malicious Code Protection Protects T1070.001 Clear Windows Event Logs
SI-04 System Monitoring Protects T1070.001 Clear Windows Event Logs
SI-07 Software, Firmware, and Information Integrity Protects T1070.001 Clear Windows Event Logs