Procedure examples

Imminent Monitor has a feature to disable Windows Task Manager.

Donut can patch Antimalware Scan Interface (AMSI), Windows Lockdown Policy (WLDP), as well as exit-related Native API functions to avoid process termination.

During HomeLand Justice, threat actors deleted Windows events and application logs.

During the SolarWinds Compromise, APT29, used `AUDITPOL` to prevent the collection of audit logs.

During the 2016 Ukraine Electric Power Attack, Sandworm Team disabled event logging on compromised systems.

Magic Hound has executed scripts to disable the event log service.

Threat Group-3390 has used appcmd.exe to disable logging on a victim server.

Wevtutil can be used to disable specific event logs on the system.

APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from Microsoft 365 tenants.

Pacu can disable or otherwise restrict various AWS logging services, such as AWS CloudTrail and VPC flow logs.

PHASEJAM has prevented legitimate Ivanti Connect Secure system upgrades by intercepting the upgrade command and rendering fake HTML upgrade progress bar through a function called `processUpgradeDisplay()` which allowed the compromised device to remain under the control of the adversary.

Ebury disables OpenSSH, system (`systemd`), and audit logs (`/sbin/auditd`) when the backdoor is active.

During Operation AkaiRyū, MirrorFace cleared Windows event logs post compromise.

During Operation Wocao, the threat actors deleted all Windows system and security event logs using `/Q /c wevtutil cl system` and `/Q /c wevtutil cl security`.

APT38 clears Window Event logs and Sysmon logs from the system.

Indrik Spider has used Cobalt Strike to empty log files. Additionally, Indrik Spider has cleared all event logs using `wevutil`.

Volt Typhoon has selectively cleared Windows Event Logs, system logs, and other technical artifacts to remove evidence of intrusion activity.

APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.

Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.

APT32 has cleared select event log entries.

HAFNIUM has cleared actor-performed actions from logs.

Aquatic Panda clears Windows Event Logs following activity to evade defenses.

FIN5 has cleared event logs from victims.

Chimera has cleared event logs on compromised hosts.

MirrorFace has deleted Windows event logs.

APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.

Play has used tools to remove log files on targeted systems.

FIN8 has cleared logs during post compromise cleanup activities.

SynAck clears event logs.

RansomHub can delete events from the Security, System, and Application logs.

Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.

DUSTTRAP can delete infected system log information.

Mafalda can delete Windows Event logs by invoking the `OpenEventLogW` and `ClearEventLogW` functions.

ShrinkLocker calls Wevtutil to clear the Windows PowerShell and Microsoft-Windows-Powershell/Operational logs.

Apostle will attempt to delete all event logs on a victim machine following file wipe activity.

BlackCat can clear Windows event logs using `wevtutil.exe`.

Lucifer can clear and remove event logs.

The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.

NotPetya uses wevtutil to clear the Windows event logs.

RunningRAT contains code to clear event logs.

MultiLayer Wiper removes Windows event logs during execution.

LockBit 3.0 can delete log files on targeted systems.

Hydraq creates a backdoor through which remote attackers can clear all system event logs.

gh0st RAT is able to wipe event logs.

HermeticWiper can overwrite the `C:\Windows\System32\winevt\Logs` file on a targeted system.

LockBit 2.0 can delete log files through the use of wevtutil.

FinFisher clears the system event logs using OpenEventLog/ClearEventLog APIs .

ZxShell has a command to clear system event logs.

Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.

KillDisk deletes Application, Security, Setup, and System Windows Event Logs.