Sigma rule: Suspicious Eventlog Clear

Rule

Title

Suspicious Eventlog Clear

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2022-09-12

Modified

2025-10-06

File

rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs

Log source

product

windows

category

ps_script

definition

Requirements: Script Block Logging must be enabled

Detection

selection:
    - ScriptBlockText|contains:
          - 'Clear-EventLog '
          - 'Remove-EventLog '
          - 'Limit-EventLog '
          - 'Clear-WinEvent '
    - ScriptBlockText|contains|all:
          - 'Eventing.Reader.EventLogSession' # [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($_.LogName)
          - 'ClearLog'
    - ScriptBlockText|contains|all:
          - 'Diagnostics.EventLog'
          - 'Clear'
condition: selection

False positives (as the rule lists them)

• Rare need to clear logs before doing something. Sometimes used by installers or cleaner scripts. The script should be investigated to determine if it's legitimate

Tags

• attack.defense-impairment
• attack.t1685.005

MITRE ATT&CK ids this rule names

• T1685.005

Related rules

• cc36992a-4671-4f21-a91d-6c2b72a2edf5 (derived)

References

• https://twitter.com/oroneequalsone/status/1568432028361830402
• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
• https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
• https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
• https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_
• https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml