Techniques › T1685.005 › AN1472
AN1472 Analytic 1472
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects behavioral sequence where an adversary gains elevated privileges and clears event logs using native binaries (e.g., wevtutil), PowerShell, or direct file deletion of .evtx files.</p>
- Detects
- T1685.005 Clear Windows Event Logs
- Part of
- DET0532 Detection of Event Log Clearing on Windows via Behavioral Chain
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=1102 | DC0038 Application Log Content |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=23 | DC0040 File Deletion |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Time range between log-clearing command and 1102 event; tunable to reduce false positives |
UserContext | Filter by admin/elevated users; allow tuning to detect abuse of high-privilege accounts |
CommandLinePattern | Match common variations of log-clearing commands like `Remove-EventLog`, `wevtutil cl` |
TargetLogName | Scope detection to Security, System, Application, or custom logs based on environment |