DET0532 Detection of Event Log Clearing on Windows via Behavioral Chain
| Item |
Value |
| ID |
DET0532 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1070.001 (Clear Windows Event Logs)
Analytics
Windows
AN1472
Detects behavioral sequence where an adversary gains elevated privileges and clears event logs using native binaries (e.g., wevtutil), PowerShell, or direct file deletion of .evtx files.
Log Sources
Mutable Elements
| Field |
Description |
| TimeWindow |
Time range between log-clearing command and 1102 event; tunable to reduce false positives |
| UserContext |
Filter by admin/elevated users; allow tuning to detect abuse of high-privilege accounts |
| CommandLinePattern |
Match common variations of log-clearing commands like Remove-EventLog, wevtutil cl |
| TargetLogName |
Scope detection to Security, System, Application, or custom logs based on environment |