kevmap

Techniques › T1070 › T1070.001

T1070.001 Clear Windows Event Logs revoked

stealth — Windows · attack.mitre.org · JSON

Revoked in ATT&CK; superseded by T1685.005. Shown because CTID mappings still reference it.

0
MITRE detection strategies
0
analytics
0
Sigma rules tagged attack.t1070.001
1
KEV CVEs mapped here
<p>Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.</p><p>With administrator privileges, the event logs can be cleared with the following utility commands:</p>
    <li><code>wevtutil cl system</code></li><li><code>wevtutil cl application</code></li><li><code>wevtutil cl security</code></li>
<p>These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell. For example, adversaries may use the PowerShell command <code>Remove-EventLog -LogName Security</code> to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.</p><p>Adversaries may also attempt to clear logs by directly deleting the stored log files within C:\Windows\System32\winevt\logs\.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVEVendor / productMapping typeStateAdded
CVE-2023-36884Microsoft Windows secondary impact Stale2023-07-17

Detection strategy · ATT&CK Enterprise v19.2

MITRE publishes no detection strategy for this technique in v19.2.

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1070.001

No Sigma rule carries this tag. 1 actively exploited CVE maps here.

Rules tagged at the parent level (attack.t1070) 20

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

IIS WebServer Log Deletion via CommandLine Utilities mediumexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-09-02 · logsource: product=windows category=process_creation · 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
Techniques: T1070
Terminal Server Client Connection History Cleared - Registry hightest
Author: Christian Burkard (Nextron Systems) · 2021-10-19 (modified 2023-02-08) · logsource: product=windows category=registry_delete · 07bdd2f5-9c58-4f38-aec8-e101bb79ef8d
Detects the deletion of registry keys containing the MSTSC connection history
Techniques: T1070T1112
Remove Exported Mailbox from Exchange Webserver hightest
Author: Christian Burkard (Nextron Systems) · 2021-08-27 (modified 2023-01-23) · logsource: product=windows service=msexchange-management · 09570ae5-889e-43ea-aac0-0e1221fb3d95
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
Techniques: T1070
Disable of ETW Trace - Powershell hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-28 (modified 2022-11-25) · logsource: product=windows category=ps_script · 115fdba9-f017-42e6-84cf-d5573bf2ddf8
Detects usage of powershell cmdlets to disable or remove ETW trace sessions
Techniques: T1070T1685
SES Identity Has Been Deleted mediumtest
Author: Janantha Marasinghe · 2022-12-13 (modified 2022-12-28) · logsource: product=aws service=cloudtrail · 20f754db-d025-4a8f-9d74-e0037e999a9a
Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities
Techniques: T1070
Tomcat WebServer Logs Deleted mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-16 · logsource: product=windows category=file_delete · 270185ff-5f50-4d6d-a27f-24c3b8c9fef8
Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence
Techniques: T1070
Kubernetes Events Deleted mediumtest
Author: Leo Tsaousis (@laripping) · 2024-03-26 · logsource: product=kubernetes category=application service=audit · 3132570d-cab2-4561-9ea6-1743644b2290
Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.
Techniques: T1070
IIS WebServer Access Logs Deleted mediumtest
Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-09-16 (modified 2023-02-15) · logsource: product=windows category=file_delete · 3eb8c339-a765-48cc-a150-4364c04652bf
Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Techniques: T1070
Filter Driver Unloaded Via Fltmc.EXE mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-13 (modified 2025-10-07) · logsource: product=windows category=process_creation · 4931188c-178e-4ee7-a348-39e8a7a56821
Detect filter driver unloading activity via fltmc.exe
Techniques: T1070T1685T1685.001
Sysmon Driver Unloaded Via Fltmc.EXE hightest
Author: Kirill Kiryanov, oscd.community · 2019-10-23 (modified 2023-02-13) · logsource: product=windows category=process_creation · 4d7cda18-1b12-4e52-b45c-d28653210df8
Detects possible Sysmon filter driver unloaded via fltmc.exe
Techniques: T1070T1685T1685.001
EventLog EVTX File Deleted mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 · logsource: product=windows category=file_delete · 63c779ba-f638-40a0-a593-ddd45e8b1ddc
Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence
Techniques: T1070
Linux Package Uninstall lowtest
Author: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems) · 2023-03-09 · logsource: product=linux category=process_creation · 95d61234-7f56-465c-6f2d-b562c6fedbc4
Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".
Techniques: T1070
DLL Load By System Process From Suspicious Locations mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-07-17 (modified 2023-09-18) · logsource: product=windows category=image_load · 9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c
Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"
Techniques: T1070
ETW Trace Evasion Activity hightest
Author: @neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · 2019-03-22 (modified 2022-06-28) · logsource: product=windows category=process_creation · a238b5d0-ce2d-4414-a676-7a531b3d13d6
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
Techniques: T1070T1685
Exchange PowerShell Cmdlet History Deleted hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-26 (modified 2022-12-30) · logsource: product=windows category=file_delete · a55349d8-9588-4c5a-8e3b-1925fe2a4ffe
Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence
Techniques: T1070
Fsutil Suspicious Invocation highstable
Author: Ecco, E.M. Anhaus, oscd.community · 2019-09-26 (modified 2023-09-09) · logsource: product=windows category=process_creation · add64136-62e5-48ea-807e-88638d02df1e
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).
Techniques: T1070T1485
Clearing Windows Console History hightest
Author: Austin Songer @austinsonger · 2021-11-25 (modified 2022-12-25) · logsource: product=windows category=ps_script · bde47d4b-9987-405c-94c7-b080410e8ea7
Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
Techniques: T1070T1070.003
Shadow Copies Deletion Using Operating Systems Utilities highstable
Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades) · 2019-10-22 (modified 2022-11-03) · logsource: product=windows category=process_creation · c947b146-0abc-4c87-9c64-b17e9d7274a2
Shadow Copies deletion using operating systems utilities
Techniques: T1070T1490
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE mediumtest
Author: @neu5ron · 2019-02-07 (modified 2023-02-15) · logsource: product=windows category=process_creation · c9fbe8e9-119d-40a6-9b59-dd58a5d84429
Detects potential malicious and unauthorized usage of bcdedit.exe
Techniques: T1070T1542.003
PowerShell Console History Logs Deleted mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 · logsource: product=windows category=file_delete · ff301988-c231-4bd0-834c-ac9d73b86586
Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
Techniques: T1070