Skip to content

T1070.001 Clear Windows Event Logs

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer’s alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.

With administrator privileges, the event logs can be cleared with the following utility commands:

  • wevtutil cl system
  • wevtutil cl application
  • wevtutil cl security

These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell. For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.1

Adversaries may also attempt to clear logs by directly deleting the stored log files within C:\Windows\System32\winevt\logs\.

Item Value
ID T1070.001
Sub-techniques T1070.001, T1070.002, T1070.003, T1070.004, T1070.005, T1070.006, T1070.007, T1070.008, T1070.009, T1070.010
Tactics TA0005
Platforms Windows
Version 1.5
Created 28 January 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S1133 Apostle Apostle will attempt to delete all event logs on a victim machine following file wipe activity.37
G0007 APT28 APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.643
G0050 APT32 APT32 has cleared select event log entries.49
G0082 APT38 APT38 clears Window Event logs and Sysmon logs from the system.47
G0096 APT41 APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.44
G0143 Aquatic Panda Aquatic Panda clears Windows Event Logs following activity to evade defenses.42
S1068 BlackCat BlackCat can clear Windows event logs using wevtutil.exe.21
S0089 BlackEnergy The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.28
G0114 Chimera Chimera has cleared event logs on compromised hosts.41
G0035 Dragonfly Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.48
S1159 DUSTTRAP DUSTTRAP can delete infected system log information.36
G0053 FIN5 FIN5 has cleared event logs from victims.50
G0061 FIN8 FIN8 has cleared logs during post compromise cleanup activities.39
S0182 FinFisher FinFisher clears the system event logs using OpenEventLog/ClearEventLog APIs .2019
S0032 gh0st RAT gh0st RAT is able to wipe event logs.3132
G0125 HAFNIUM HAFNIUM has cleared actor-performed actions from logs.51
S0697 HermeticWiper HermeticWiper can overwrite the C:\Windows\System32\winevt\Logs file on a targeted system.23
S0698 HermeticWizard HermeticWizard has the ability to use wevtutil cl system to clear event logs.23
S0203 Hydraq Hydraq creates a backdoor through which remote attackers can clear all system event logs.3334
G0119 Indrik Spider Indrik Spider has used Cobalt Strike to empty log files.46 Additionally, Indrik Spider has cleared all event logs using wevutil.45
S0607 KillDisk KillDisk deletes Application, Security, Setup, and System Windows Event Logs.28
S1199 LockBit 2.0 LockBit 2.0 can delete log files through the use of wevtutil.26252427
S1202 LockBit 3.0 LockBit 3.0 can delete log files on targeted systems.89
S0532 Lucifer Lucifer can clear and remove event logs.17
S1060 Mafalda Mafalda can delete Windows Event logs by invoking the OpenEventLogW and ClearEventLogW functions.16
S0688 Meteor Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.10
S1135 MultiLayer Wiper MultiLayer Wiper removes Windows event logs during execution.35
S0368 NotPetya NotPetya uses wevtutil to clear the Windows event logs.1213
S0365 Olympic Destroyer Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.18
C0014 Operation Wocao During Operation Wocao, the threat actors deleted all Windows system and security event logs using /Q /c wevtutil cl system and /Q /c wevtutil cl security.54
G1040 Play Play has used tools to remove log files on targeted systems.5253
S0192 Pupy Pupy has a module to clear event logs with PowerShell.7
S1242 Qilin Qilin has the ability to clear Windows Event Logs.3029
S1212 RansomHub RansomHub can delete events from the Security, System, and Application logs.14
S0253 RunningRAT RunningRAT contains code to clear event logs.38
S1178 ShrinkLocker ShrinkLocker calls Wevtutil to clear the Windows PowerShell and Microsoft-Windows-Powershell/Operational logs.15
S0242 SynAck SynAck clears event logs.11
G1017 Volt Typhoon
Volt Typhoon has selectively cleared Windows Event Logs, system logs, and other technical artifacts to remove evidence of intrusion activity.40
S0645 Wevtutil Wevtutil can be used to clear system and security event logs from the system.56
S0412 ZxShell ZxShell has a command to clear system event logs.22

Mitigations

ID Mitigation Description
M1041 Encrypt Sensitive Information Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.
M1029 Remote Data Storage Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
M1022 Restrict File and Directory Permissions Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

References

  1. Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022. ↩

  2. Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018. ↩

  3. Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2, 2018. ↩

  4. Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July 2, 2018. ↩

  5. Microsoft. (n.d.). wevtutil. Retrieved September 14, 2021. ↩

  6. Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016. ↩↩

  7. Nicolas Verdier. (n.d.). Retrieved January 29, 2018. ↩

  8. CISA et al. (2023, June 14). UNDERSTANDING RANSOMWARE THREAT ACTORS: LOCKBIT. Retrieved February 5, 2025. ↩

  9. FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025. ↩

  10. Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022. ↩

  11. Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018. ↩

  12. Chiu, A. (2016, June 27). New Ransomware Variant “Nyetya” Compromises Systems Worldwide. Retrieved March 26, 2019. ↩

  13. Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020. ↩

  14. Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025. ↩

  15. Cristian Souza, Eduardo Ovalle, Ashley Muñoz, & Christopher Zachor. (2024, May 23). ShrinkLocker: Turning BitLocker into ransomware. Retrieved December 7, 2024. ↩

  16. Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023. ↩

  17. Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020. ↩

  18. Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019. ↩

  19. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018. ↩

  20. FinFisher. (n.d.). Retrieved September 12, 2024. ↩

  21. Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022. ↩

  22. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019. ↩

  23. ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022. ↩↩

  24. Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: LockBit 2.0 - All Paths Lead to Ransom. Retrieved January 24, 2025. ↩

  25. Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025. ↩

  26. FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025. ↩

  27. SentinelOne. (n.d.). LockBit 2.0: In-Depth Analysis, Detection, Mitigation, and Removal. Retrieved January 24, 2025. ↩

  28. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved May 18, 2016. ↩↩

  29. Bradshaw, A. et al. (2025, April 1). Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream. Retrieved September 26, 2025. ↩

  30. Halcyon RISE Team. (2024, October 24). New Qilin.B Ransomware Variant Boasts Enhanced Encryption and Defense Evasion. Retrieved September 26, 2025. ↩

  31. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016. ↩

  32. Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020. ↩

  33. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018. ↩

  34. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018. ↩

  35. Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024. ↩

  36. Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024. ↩

  37. Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024. ↩

  38. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018. ↩

  39. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018. ↩

  40. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. ↩

  41. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024. ↩

  42. CrowdStrike. (2023). 2022 Falcon OverWatch Threat Hunting Report. Retrieved May 20, 2024. ↩

  43. Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024. ↩

  44. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. ↩

  45. Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024. ↩

  46. Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021. ↩

  47. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024. ↩

  48. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018. ↩

  49. Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017. ↩

  50. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017. ↩

  51. Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025. ↩

  52. CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024. ↩

  53. Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024. ↩

  54. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩