Windows Event Log was cleared using wevtutil.exe

Cortex XDR Analytics Alert Reference by data source

Product
Cortex XDR
Last date published
2025-01-19
Category
Analytics Alert Reference
Index by
data source

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

1 Day

Required Data

  • Requires:
    • XDR Agent

Detection Modules

Detector Tags

ATT&CK Tactic

Impact (TA0040)

ATT&CK Technique

Inhibit System Recovery (T1490)

Severity

Low

Description

A command line utility was used to clear the Windows Event Log.
It may be used to delete logs to cover the tracks of the malicious activity, making it harder to perform analysis.

Attacker's Goals

Delete logs to cover tracks of the malicious activity, making it harder to perform analysis.

Investigative actions

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.

Variations

Security Event Log was cleared using wevtutil.exe

Synopsis

ATT&CK Tactic

Impact (TA0040)

ATT&CK Technique

Inhibit System Recovery (T1490)

Severity

High

Description

A command line utility was used to clear the Windows Event Log.
It may be used to delete logs to cover the tracks of the malicious activity, making it harder to perform analysis.

Attacker's Goals

Delete logs to cover tracks of the malicious activity, making it harder to perform analysis.

Investigative actions

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.


A Sensitive Windows Event Log was cleared using wevtutil.exe

Synopsis

ATT&CK Tactic

Impact (TA0040)

ATT&CK Technique

Inhibit System Recovery (T1490)

Severity

Medium

Description

A command line utility was used to clear the Windows Event Log.
It may be used to delete logs to cover the tracks of the malicious activity, making it harder to perform analysis.

Attacker's Goals

Delete logs to cover tracks of the malicious activity, making it harder to perform analysis.

Investigative actions

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.