Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.


With administrator privileges, the event logs can be cleared with the following utility commands:

* <code>wevtutil cl system</code>
* <code>wevtutil cl application</code>
* <code>wevtutil cl security</code>

These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command <code>Remove-EventLog -LogName Security</code> to delete the Security EventLog and after reboot, disable future logging.  Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging)

Adversaries may also attempt to clear logs by directly deleting the stored log files within `C:\Windows\System32\winevt\logs\`.
Clear Windows Event Logs
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1070/001  external_id: T1070.001     source_name: disable_win_evt_logging  description: Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.  url: https://ptylu.github.io/content/report/report.html?report=25     source_name: Microsoft Clear-EventLog  description: Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018.  url: https://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventlog     source_name: Microsoft EventLog.Clear  description: Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2, 2018.  url: https://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspx     source_name: Microsoft wevtutil Oct 2017  description: Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July 2, 2018.  url: https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil     