Windows Event Log Clearing Detected

Attackers frequently target Windows Event Logs to cover their tracks after gaining access to a system. By clearing or disabling these logs, they aim to evade detection, hinder forensic investigations, and prolong their presence on the compromised network. This activity is typically performed using the wevtutil.exe utility or the Clear-EventLog PowerShell cmdlet. Elastic has observed and documented this technique, providing a rule that detects such attempts across various data sources, including endpoint telemetry and security event logs. The rule aims to identify malicious usage of these tools for defense evasion.

Attack Chain

1. Initial access is gained through methods such as phishing or exploiting vulnerabilities (not directly covered in the source).
2. The attacker executes a privileged shell, such as cmd.exe or powershell.exe.
3. The attacker uses wevtutil.exe with the cl or clear-log argument to clear specific event logs (e.g., Security, Application, System). Alternatively, the /e:false argument is used to disable specific event logs.
4. If PowerShell is available, the attacker may use the Clear-EventLog cmdlet to achieve the same result.
5. The attacker removes traces of their actions by deleting relevant command history files or modifying timestamps.
6. The attacker continues lateral movement or other malicious activities, now with reduced risk of detection due to the cleared logs.
7. The attacker exfiltrates data, deploys ransomware, or achieves other objectives.

Impact

Successful clearing of Windows Event Logs can severely impair an organization's ability to detect and respond to security incidents. Without proper logging, administrators lose visibility into malicious activities, making it difficult to identify compromised systems and understand the scope of an attack. This can lead to delayed incident response, increased dwell time for attackers, and greater potential for data loss or system damage. The rule has a risk score of 21, indicating a potentially serious compromise.

Recommendation

• Deploy the provided Sigma rule to detect the execution of wevtutil.exe or Clear-EventLog with suspicious arguments in your SIEM, and tune for your environment.
• Enable Sysmon process-creation logging to capture command-line arguments for wevtutil.exe and powershell.exe, activating relevant portions of the Sigma rules.
• Investigate any alerts generated by this rule by examining process execution chains and user accounts to identify potentially malicious activity.
• Review and harden event log security policies to prevent unauthorized clearing or disabling of logs.
• Monitor Windows Security Event Logs for Event ID 1102 (Audit log was cleared) as an alternative detection method.