Compliance Node Overview
MITRE ATT&CK T1685.005 (Clear Windows Event Logs) is an Enterprise Defense Impairment technique. Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: * `wevtutil cl system` * `wevtutil cl application` * `wevtutil cl security` These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell. For example, adversaries may use the PowerShell command `Remove-EventLog -LogName Security` to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated... Affected platforms: Windows. Sub-technique of ATT&CK T1685. ATT&CK-mapped mitigations: M1029 Remote Data Storage, M1041 Encrypt Sensitive Information, M1022 Restrict File and Directory Permissions.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1685/005/
SHA-256 integrity: 27a6d1ba110ad95f746c963b7978c7c8fc168c3e07a45e3fafa801b96e6eca97
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1685.005: Clear Windows Event Logs (https://attack.mitre.org/techniques/T1685/005/)
- MITRE ATT&CK Tactic TA0112: Defense Impairment (https://attack.mitre.org/tactics/TA0112/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access