T1685.005 — Clear Windows Event Logs

Tactic: Defense Impairment · Platforms: Windows

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success…

Sub-technique of Disable or Modify Tools (T1685).

Sigma detection rules (1)

T1685.005 Disable or Modify Tools: Clear Windows Event Logs

title: "T1685.005 Disable or Modify Tools: Clear Windows Event Logs"
id: 6983c3fd-06d2-4e66-bf28-e27eaba2c5c2
description: 'Detection of Event Log Clearing on Windows via Behavioral Chain. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, UserContext, CommandLinePattern, TargetLogName.'
references:
  - https://attack.mitre.org/techniques/T1685/005
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.005

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\wevtutil.exe'

  selection_cmd:
    CommandLine|re: '(?i)(^|\s)(cl|clear-log)(\s|$)'

  condition: selection and selection_cmd

falsepositives:
  - Legitimate log-retention/rotation maintenance scripts — rare enough to warrant review on any endpoint outside a documented maintenance window.

level: critical

Related sub-techniques

Explore