ATT&CK technique
View on MITRE ATT&CK →
T1685.005
Clear Windows Event Logs
Defense Impairment
13 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Disable Logs Using WevtUtil | production | 2026-10-02 |
| splunk | Windows Eventlog Cleared Via Wevtutil | production | 2026-10-02 |
| splunk | Windows Event Logging Service Has Shutdown | production | 2026-10-02 |
| splunk | Windows Event Log Cleared | production | 2026-10-02 |
| splunk | Suspicious wevtutil Usage | production | 2026-10-02 |
| sigma | Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog | test | 2026-07-01 |
| sigma | Suspicious Eventlog Clearing or Configuration Change Activity | stable | 2026-06-01 |
| sigma | Suspicious Eventlog Clear | test | 2025-10-06 |
| sigma | Important Windows Eventlog Cleared | test | 2023-11-15 |
| sigma | Eventlog Cleared | test | 2023-11-15 |
| sigma | Suspicious Windows Trace ETW Session Tamper Via Logman.EXE | test | 2023-02-21 |
| sigma | NotPetya Ransomware Activity | test | 2022-12-15 |
| sigma | Security Eventlog Cleared | test | 2022-02-24 |