Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
The event logs can be cleared with the following utility commands:
These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell.
View in MITRE ATT&CK®Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
action.malware.variety.Destroy data | Destroy or corrupt stored data | related-to | T1070.001 | Indicator Removal on Host: Clear Windows Event Logs | |
attribute.integrity.variety.Log tampering | Log tampering or modification | related-to | T1070.001 | Indicator Removal on Host: Clear Windows Event Logs |