T1070.001 Clear Windows Event Logs
Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer’s alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
The event logs can be cleared with the following utility commands:
wevtutil cl system
wevtutil cl application
wevtutil cl security
These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell. For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security
to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.1
Item | Value |
---|---|
ID | T1070.001 |
Sub-techniques | T1070.001, T1070.002, T1070.003, T1070.004, T1070.005, T1070.006, T1070.007, T1070.008, T1070.009 |
Tactics | TA0005 |
Platforms | Windows |
Version | 1.2 |
Created | 28 January 2020 |
Last Modified | 12 April 2023 |
Procedure Examples
ID | Name | Description |
---|---|---|
G0007 | APT28 | APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security .630 |
G0050 | APT32 | APT32 has cleared select event log entries.26 |
G0082 | APT38 | APT38 clears Window Event logs and Sysmon logs from the system.27 |
G0096 | APT41 | APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.31 |
S1068 | BlackCat | BlackCat can clear Windows event logs using wevtutil.exe .14 |
S0089 | BlackEnergy | The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.10 |
G0114 | Chimera | Chimera has cleared event logs on compromised hosts.34 |
G0035 | Dragonfly | Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.32 |
G0053 | FIN5 | FIN5 has cleared event logs from victims.28 |
G0061 | FIN8 | FIN8 has cleared logs during post compromise cleanup activities.29 |
S0182 | FinFisher | FinFisher clears the system event logs using OpenEventLog/ClearEventLog APIs .2021 |
S0032 | gh0st RAT | gh0st RAT is able to wipe event logs.1112 |
S0697 | HermeticWiper | HermeticWiper can overwrite the C:\Windows\System32\winevt\Logs file on a targeted system.15 |
S0698 | HermeticWizard | HermeticWizard has the ability to use wevtutil cl system to clear event logs.15 |
S0203 | Hydraq | Hydraq creates a backdoor through which remote attackers can clear all system event logs.2425 |
G0119 | Indrik Spider | Indrik Spider has used Cobalt Strike to empty log files.33 |
S0607 | KillDisk | KillDisk deletes Application, Security, Setup, and System Windows Event Logs.10 |
S0532 | Lucifer | Lucifer can clear and remove event logs.22 |
S1060 | Mafalda | Mafalda can delete Windows Event logs by invoking the OpenEventLogW and ClearEventLogW functions.19 |
S0688 | Meteor | Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.18 |
S0368 | NotPetya | NotPetya uses wevtutil to clear the Windows event logs.89 |
S0365 | Olympic Destroyer | Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil .17 |
C0014 | Operation Wocao | During Operation Wocao, the threat actors deleted all Windows system and security event logs using /Q /c wevtutil cl system and /Q /c wevtutil cl security .35 |
S0192 | Pupy | Pupy has a module to clear event logs with PowerShell.7 |
S0253 | RunningRAT | RunningRAT contains code to clear event logs.13 |
S0242 | SynAck | SynAck clears event logs.16 |
S0645 | Wevtutil | Wevtutil can be used to clear system and security event logs from the system.56 |
S0412 | ZxShell | ZxShell has a command to clear system event logs.23 |
Mitigations
ID | Mitigation | Description |
---|---|---|
M1041 | Encrypt Sensitive Information | Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary. |
M1029 | Remote Data Storage | Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system. |
M1022 | Restrict File and Directory Permissions | Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities. |
Detection
ID | Data Source | Data Component |
---|---|---|
DS0017 | Command | Command Execution |
DS0022 | File | File Deletion |
DS0009 | Process | OS API Execution |
References
-
Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022. ↩
-
Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018. ↩
-
Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2, 2018. ↩
-
Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July 2, 2018. ↩
-
Microsoft. (n.d.). wevtutil. Retrieved September 14, 2021. ↩
-
Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016. ↩↩
-
Chiu, A. (2016, June 27). New Ransomware Variant “Nyetya” Compromises Systems Worldwide. Retrieved March 26, 2019. ↩
-
Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020. ↩
-
Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved May 18, 2016. ↩↩
-
FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016. ↩
-
Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020. ↩
-
Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018. ↩
-
Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022. ↩
-
ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022. ↩↩
-
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018. ↩
-
Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019. ↩
-
Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022. ↩
-
Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023. ↩
-
Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018. ↩
-
Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020. ↩
-
Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019. ↩
-
Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018. ↩
-
Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018. ↩
-
Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017. ↩
-
FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018. ↩
-
Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017. ↩
-
Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018. ↩
-
Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018. ↩
-
Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. ↩
-
US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018. ↩
-
Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021. ↩
-
Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021. ↩
-
Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩