Detect Clear Windows Event Logs in CrowdStrike LogScale
Adversaries clear Windows Event Logs to remove evidence of intrusion activity. Primary methods include the wevtutil command-line utility (wevtutil cl system/security/application), the PowerShell Remove-EventLog cmdlet, the Windows Event Viewer GUI, and direct deletion of .evtx log files from C:\Windows\System32\winevt\logs\. When a log is cleared, Windows generates Event ID 1102 (Security log cleared) in the Security log and Event ID 104 (System log cleared) in the System log — but these disappear if the generating log is also cleared. APT28, APT38, APT41, Volt Typhoon, LockBit 2.0/3.0, RansomHub, NotPetya, Olympic Destroyer, BlackCat, and many others routinely clear event logs as post-compromise cleanup.
MITRE ATT&CK
- Tactic
- Defense Impairment
- Technique
- T1685 Disable or Modify Tools
- Sub-technique
- T1685.005 Clear Windows Event Logs
- Canonical reference
- https://attack.mitre.org/techniques/T1685/005/
LogScale Detection Query
(
#event_simpleName in [ProcessRollup2, SyntheticProcessRollup2]
| FileName = "wevtutil.exe"
| CommandLine = /\b(cl|clear-log|clear)\b/i
| DetectionType := "WevtutilClear"
)
| union (
#event_simpleName in [ProcessRollup2, SyntheticProcessRollup2]
| FileName = /powershell(ise)?\.exe/i
| CommandLine = /(Remove-EventLog|Clear-EventLog)/i
| DetectionType := "PowerShellClear"
)
| table([_time, ComputerName, UserName, FileName, CommandLine, DetectionType])
| sort(_time, order=desc, limit=200)Detects Windows Event Log clearing in CrowdStrike Falcon LogScale by querying ProcessRollup2 and SyntheticProcessRollup2 events for two detection branches: wevtutil.exe invocations with clear-family command arguments (cl, clear-log, clear), and PowerShell or PowerShell ISE processes executing Remove-EventLog or Clear-EventLog cmdlets. Results are unioned and labeled with DetectionType for analyst triage.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor upgrades or policy deployments that trigger automated wevtutil calls to clear diagnostic event logs
- IT automation tools such as Ansible, Chef, or Puppet clearing event logs as part of Windows workstation provisioning or hardening runbooks
- Help desk staff executing Clear-EventLog via interactive or remote PowerShell sessions to resolve event log corruption on endpoints
Other platforms for T1685.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Clear Security Event Log with wevtutil
Expected signal: Windows Event Log: Security Event ID 1102 (The audit log was cleared) generated just before the log is cleared. Sysmon Event ID 1: wevtutil.exe process creation with 'cl Security' argument. After clearing, the Security log is empty except for the Event ID 4608 (Windows is starting up) that follows a fresh log.
- Test 2 Clear Multiple Event Logs Using wevtutil Loop
Expected signal: Multiple Sysmon Event ID 1 events for wevtutil.exe with different log names. Security Event ID 1102 for Security log. System Event ID 104 for each other log cleared. The for loop structure will appear in the parent cmd.exe command line.
- Test 3 Clear Event Log via PowerShell Remove-EventLog
Expected signal: PowerShell process creation with Remove-EventLog command. Sysmon Event ID 13 (Registry): removal of the EventLog registry key under HKLM\SYSTEM\CurrentControlSet\Services\EventLog\ArgusTest. System Event ID 104 may be generated for the deleted log.
Response Playbook
Triage
- Check Event ID 1102 (Security) and 104 (System) to identify which logs were cleared and at what time
- Identify who cleared the log: the Subject Account in Event ID 1102 shows the user context — was this a known admin account or service account?
- Check whether the clearing was preceded by suspicious activity in the same timeframe — log clearing immediately after high-severity events (4624 logons, 4688 process creates) is a strong indicator of cover-up
- Review wevtutil.exe process creation: what was the parent process? A PowerShell or cmd.exe spawned by an Office macro or LOLBin is highly suspicious
- Check for log forwarding: if your SIEM was receiving logs before clearing, review the last events in the forwarded stream to understand what the attacker is trying to hide
- Look for lateral movement indicators: if the attacker cleared logs after moving laterally, their origin may still be visible in other log sources (VPN, firewall, web proxy)
Containment
- Isolate the affected endpoint if active intrusion is suspected beyond the log clearing
- Preserve any remaining event logs and memory immediately — log clearing may be the last cleanup step before the attacker completes their objective
- Check if other hosts have had their logs cleared — this is often a campaign-wide cleanup step
- Enable centralized log forwarding if not already in place — this prevents on-host clearing from destroying forensic evidence
Evidence Collection
- Event ID 1102 (Security log): contains Subject Account, Domain, Logon ID of the user who cleared the log
- Event ID 104 (System log): contains the channel name that was cleared and the user who cleared it
- Sysmon Event ID 1: wevtutil.exe process creation with full command line arguments
- Windows Security logs (if not cleared): 4688 events around the clearing time showing what else was executed
- SIEM-forwarded events: if log shipping was active, events forwarded before clearing are still available
- VSS shadow copies: may contain previous log files — use vssadmin list shadows to check availability
- Registry: HKLM\SYSTEM\CurrentControlSet\Services\EventLog — shows which event logs exist and their configuration
Escalation Criteria
- !Log clearing immediately following suspicious network connections, credential access, or lateral movement indicators
- !Multiple log types cleared (Security + System + Application) — comprehensive cleanup attempt
- !Log clearing via a remote session (RDP or PSRemoting) — attacker clearing logs after remote access
- !Log clearing by a non-admin account that somehow acquired the SeClearAuditPrivilege privilege
- !Log clearing immediately before or after ransomware file encryption activity
Investigation Guide
Forensic Artifacts
- >
Windows Event Log: Event ID 1102 in Security log (generated at time of clearing) - >
Windows Event Log: Event ID 104 in System log (generated when non-Security logs are cleared) - >
File System: C:\Windows\System32\winevt\logs\*.evtx — check file modification timestamps (last clear = last modification) - >
Registry: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\<logname>\MaxSize — may have been modified to force auto-overwrite - >
Prefetch: C:\Windows\Prefetch\WEVTUTIL.EXE-*.pf — execution history and parameters - >
SIEM: Last forwarded events before the gap — analyze the timeline of events just before clearing
Tuning Guidance
Event ID 1102 has very low false positive rates — very few legitimate administrative processes clear the Security log. Build an allowlist of known maintenance windows and accounts authorized to perform log clearing. Alert immediately on any 1102 or 104 events outside of approved windows. For wevtutil.exe monitoring, the key is the parent process: wevtutil.exe spawned from Task Scheduler or an approved admin script is different from wevtutil.exe spawned from cmd.exe which was spawned from a document. Consider using WEF (Windows Event Forwarding) to forward all logs to a centralized SIEM before they can be cleared on the endpoint.
Hunting Queries
Hunt for endpoints with repeated Security log clearing events. A single clearing could be legitimate maintenance; multiple clearings on the same host suggest an adversary repeatedly covering their tracks across multiple sessions.
SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID == 1102
| summarize ClearCount=count(), Devices=dcount(Computer), Accounts=make_set(Account) by bin(TimeGenerated, 1d), Computer
| where ClearCount > 1 or Devices > 1
| sort by ClearCount descindex=wineventlog sourcetype="WinEventLog:Security" EventCode=1102
| stats count as ClearCount, dc(host) as Devices, values(user) as Accounts by date_mday, date_month, date_year, host
| where ClearCount > 1
| sort - ClearCountHunt for all log clearing commands across wevtutil.exe and PowerShell cmdlets. Focus on the parent process — legitimate clearing from admin tools has different parent chains than clearing from malware-spawned shells.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("wevtutil.exe", "powershell.exe")
| where ProcessCommandLine has_any ("cl security", "cl system", "cl application", "clear-log", "Remove-EventLog", "Clear-EventLog")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where (Image like "%wevtutil.exe" AND (CommandLine like "%cl %" OR CommandLine like "%clear-log%"))
OR (Image like "%powershell.exe" AND (CommandLine like "%Remove-EventLog%" OR CommandLine like "%Clear-EventLog%"))
| table _time, host, User, Image, CommandLine, ParentImage
| sort - _timeHunt for log clearing events that occur within 30 minutes of authentication events. An attacker who logs in and then clears logs leaves this temporal correlation as a forensic artifact even when the actual log content is erased.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 1102
| join kind=inner (
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID in (4624, 4625, 4648, 4672)
| summarize LogonCount=count(), FailedLogons=countif(EventID==4625) by Computer, bin(TimeGenerated, 30m)
) on Computer
| where abs(datetime_diff('minute', TimeGenerated, TimeGenerated1)) < 30
| project TimeGenerated, Computer, Account, LogonCount, FailedLogons
| sort by TimeGenerated descindex=wineventlog sourcetype="WinEventLog:Security" (EventCode=1102 OR EventCode=4624 OR EventCode=4625 OR EventCode=4648)
| eval event_class=case(EventCode=1102, "log_clear", EventCode=4624, "logon", EventCode=4625, "failed_logon", EventCode=4648, "explicit_cred", true(), "other")
| transaction host maxspan=30m
| where mvcount(split(event_class,",")) > 1 AND match(event_class, "log_clear")
| table _time, host, event_class, user
| sort - _timeAtomic Red Team Tests
Clears the Security event log using wevtutil.exe — the most common adversary method. This generates Event ID 1102 in the Security log immediately before clearing. Requires administrator privileges.
Command
wevtutil cl SecurityExpected Telemetry
Windows Event Log: Security Event ID 1102 (The audit log was cleared) generated just before the log is cleared. Sysmon Event ID 1: wevtutil.exe process creation with 'cl Security' argument. After clearing, the Security log is empty except for the Event ID 4608 (Windows is starting up) that follows a fresh log.
Expected Detection
Alert fires immediately on Event ID 1102. KQL: SecurityEvent where EventID == 1102. SPL: WinEventLog:Security EventCode=1102. Also captured by Sysmon process creation for wevtutil.exe cl Security.
Clears System, Application, and Security event logs in sequence — replicating the bulk clearing behavior seen in ransomware (NotPetya, Olympic Destroyer) and APT cleanup operations. Generates multiple Event ID 104 and 1102 events.
Command
for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1" 2>nulExpected Telemetry
Multiple Sysmon Event ID 1 events for wevtutil.exe with different log names. Security Event ID 1102 for Security log. System Event ID 104 for each other log cleared. The for loop structure will appear in the parent cmd.exe command line.
Expected Detection
Multiple consecutive log clearing events within seconds. Alert fires on each 1102/104 event. KQL: multiple SecurityEvent EventID 1102 from same host within 60 seconds. SPL: count of EventCode=1102 or EventCode=104 per host > 2 in 1 minute.
Uses PowerShell's Remove-EventLog cmdlet to permanently delete a custom event log source — this not only clears the log but removes the log registration entirely, requiring a reboot to recreate. Simulates the technique where attackers disable future logging.
Command
powershell.exe -Command "New-EventLog -LogName 'ArgusTest' -Source 'ArgusTestSource' 2>$null; Write-EventLog -LogName 'ArgusTest' -Source 'ArgusTestSource' -EventId 1 -Message 'Test event'; Remove-EventLog -LogName 'ArgusTest'"Expected Telemetry
PowerShell process creation with Remove-EventLog command. Sysmon Event ID 13 (Registry): removal of the EventLog registry key under HKLM\SYSTEM\CurrentControlSet\Services\EventLog\ArgusTest. System Event ID 104 may be generated for the deleted log.
Expected Detection
PowerShell process creation with Remove-EventLog in command line. Sysmon EventCode 13 for registry deletion of EventLog keys. KQL: ProcessCommandLine has 'Remove-EventLog'. SPL: Sysmon EventCode 1 where CommandLine contains 'Remove-EventLog'.