Wevutil Clear Windows Event Logs
Wevtutil Clear Logs
Query
DeviceProcessEvents
| extend ProcessCommandLineToLower = tolower(ProcessCommandLine)
| where ProcessCommandLineToLower has "wevtutil.exe" and ProcessCommandLineToLower has_any ("cl", "clear-log")
| project-reorder Timestamp, DeviceName, AccountSid, ProcessCommandLine, InitiatingProcessCommandLineAbout this query
Explanation
This query is designed to detect when someone attempts to clear Windows Event Logs using the wevtutil.exe command. Clearing these logs can be a tactic used by attackers to hide their tracks after an intrusion. The query looks for instances where the command line includes wevtutil.exe along with either "cl" or "clear-log," which are indicators of an attempt to clear logs.
The query is applied to two different platforms, Defender XDR and Sentinel, but the logic is the same for both. It processes events related to device processes, converts the command line text to lowercase for consistent matching, and filters for the specific commands associated with clearing logs. The results are then organized to show the timestamp of the event, the device name, the account SID (Security Identifier) of the user who ran the command, and the command lines involved in the process.
This detection is important because clearing event logs is a known technique (MITRE ATT&CK Technique T1070.001) used by adversaries to remove indicators of their activity, making it harder for defenders to trace their actions.
