Analytics BIOC Low
✕

Windows Event Log was cleared using wevtutil.exe

A command-line utility was used to clear the Windows Event Log. It may be used to delete logs to cover the tracks of the malicious activity, making it harder to perform analysis.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Inhibit System Recovery (T1490)
Attacker's goals:

Delete logs to cover tracks of the malicious activity, making it harder to perform analysis.

Investigative actions:

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • Security Event Log was cleared using wevtutil.exe High (parent: Low)
  • A Sensitive Windows Event Log was cleared using wevtutil.exe Medium (parent: Low)