Clear Eventlog

Identifies attempts to clear Windows event log stores. Adversaries attempt to evade detection or destroy forensic evidence on a system to cover their trails and slow down incident response.

• Platform: Windows
• Severity: Medium
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1070, T1070.001

Back to all rules