Compliance Node Overview
MITRE ATT&CK T1070.001 (Clear Windows Event Logs) is an Enterprise Defense Evasion sub-technique of T1070 (Indicator Removal). Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. Affected platforms: Windows. MITRE-documented mitigations include M1022 Restrict File and Directory Permissions, M1029 Remote Data Storage, M1041 Encrypt Sensitive Information. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, AC-16, AC-17, AC-18, AC-19.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/versions/v16/techniques/T1070/001/
SHA-256 integrity: 3248e8da91e14185e34244d0235c7d69c5911cabb1917ad395175bebc523e7af
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1070.001: Clear Windows Event Logs (https://attack.mitre.org/versions/v16/techniques/T1070/001/)
- MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access