MITRE ATT&CKsub-technique

T1685.005 Clear Windows Event Logs

Published 2026-04-14 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Defense Impairment
Platforms
Windows
Version
1.0
Created
2026-04-14

Description

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: • `wevtutil cl system` • `wevtutil cl application` • `wevtutil cl security` These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell. For example, adversaries may use the PowerShell command `Remove-EventLog -LogName Security` to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot. Adversaries may also attempt to clear logs by directly deleting the stored log files within `C:\Windows\System32\winevt\logs\`.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1685 Disable or Modify Tools technique

Tactic · MITRE ATT&CK (1)

  • TA0112 Defense Impairment tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M1041 Encrypt Sensitive Information mitigation
  • M1022 Restrict File and Directory Permissions mitigation
  • M1029 Remote Data Storage mitigation

Referenced by MITRE ATT&CK · uses (43)

  • S9051 The Gentlemen Ransomware software (malware)
  • C0060 Operation AkaiRyū campaign
  • G1054 MirrorFace group
  • S1242 Qilin software (malware)
  • S1212 RansomHub software (malware)
  • S1202 LockBit 3.0 software (malware)
  • S1199 LockBit 2.0 software (malware)
  • S1178 ShrinkLocker software (malware)
  • G1040 Play group
  • S1159 DUSTTRAP software (malware)
  • S1133 Apostle software (malware)
  • S1135 MultiLayer Wiper software (malware)
  • G1017 Volt Typhoon group
  • S1068 BlackCat software (malware)
  • S1060 Mafalda software (malware)
  • C0014 Operation Wocao campaign
  • S0697 HermeticWiper software (malware)
  • S0698 HermeticWizard software (malware)
  • S0688 Meteor software (malware)
  • G0143 Aquatic Panda group
  • S0645 Wevtutil software (tool)
  • G0125 HAFNIUM group
  • S0607 KillDisk software (malware)
  • G0119 Indrik Spider group
  • S0532 Lucifer software (malware)
  • G0114 Chimera group
  • S0412 ZxShell software (malware)
  • G0096 APT41 group
  • S0368 NotPetya software (malware)
  • S0365 Olympic Destroyer software (malware)
Show all 43 ›

Referenced by Compliance · mitigates (1)

  • CIS-3.4 Enforce Data Retention CIS Safeguard v8.1

References