Microsoft. (n.d.). wevtutil. Retrieved September 14, 2021.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1005 Data from Local System |
ToolWevtutil | Wevtutil can be used to export events from a specific log. |
| T1685.001 Disable or Modify Windows Event Log |
ToolWevtutil | Wevtutil can be used to disable specific event logs on the system. |
| T1685.005 Clear Windows Event Logs |
ToolWevtutil | Wevtutil can be used to clear system and security event logs from the system. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
