title: Suspicious Eventlog Clear or Configuration Using Wevtutil
id: cc36992a-4671-4f21-a91d-6c2b72a2edf5
status: stable
description: Detects clearing or configuration of eventlogs using wevtutil, powershell and wmic. Might be used by ransomwares during the attack (seen by NotPetya and others).
author: Ecco, Daniil Yugoslavskiy, oscd.community
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
  - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
date: 2019/09/26
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil_binary:
    Image|endswith: '\wevtutil.exe'
  selection_wevtutil_command:
    CommandLine|contains:
      - 'clear-log'       # clears specified log
      - ' cl '              # short version of 'clear-log'
      - 'set-log'         # modifies config of specified log. could be uset to set it to a tiny size
      - ' sl '              # short version of 'set-log'
  selection_other_ps:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Clear-EventLog'
      - 'Remove-EventLog'
      - 'Limit-EventLog'
  selection_other_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: ' ClearEventLog '
  condition: 1 of selection_other_* or (selection_wevtutil_binary and selection_wevtutil_command)
falsepositives:
  - Admin activity
  - Scripts and administrative tools used in the monitored environment
level: high
tags:
  - attack.defense_evasion
  - attack.t1070.001
  - car.2016-04-002
