Indicator Removal on Host: Clear Windows Event Logs

APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.^[1][2]

APT32 has cleared select event log entries.^[3]

APT38 clears Window Event logs and Sysmon logs from the system.^[4]

APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.^[5]

The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.^[6]

Chimera has cleared event logs on compromised hosts.^[7]

Dragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.^[8][9]

FIN5 has cleared event logs from victims.^[10]

FIN8 has cleared logs during post compromise cleanup activities.^[11]

FinFisher clears the system event logs using OpenEventLog/ClearEventLog APIs .^[12][13]

gh0st RAT is able to wipe event logs.^[14][15]

Hydraq creates a backdoor through which remote attackers can clear all system event logs.^[16][17]

Indrik Spider has used Cobalt Strike to empty log files.^[18]

KillDisk deletes Application, Security, Setup, and System Windows Event Logs.^[6]

Lucifer can clear and remove event logs.^[19]

NotPetya uses wevtutil to clear the Windows event logs.^[20][21]

Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.^[22]

Operation Wocao has deleted Windows Event Logs to hinder forensic investigation.^[23]

Pupy has a module to clear event logs with PowerShell.^[24]

RunningRAT contains code to clear event logs.^[25]

SynAck clears event logs.^[26]

Wevtutil can be used to clear system and security event logs from the system.^[27][1]

ZxShell has a command to clear system event logs.^[28]

Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.

Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.