diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index 381b61bc..b2c523d5 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -231,7 +231,7 @@ defense-evasion,T1070.002,Clear Linux or Mac System Logs,1,rm -rf,989cc1b1-3642- defense-evasion,T1070.002,Clear Linux or Mac System Logs,2,Overwrite Linux Mail Spool,1602ff76-ed7f-4c94-b550-2f727b4782d4,bash defense-evasion,T1070.002,Clear Linux or Mac System Logs,3,Overwrite Linux Log,d304b2dc-90b4-4465-a650-16ddd503f7b5,bash defense-evasion,T1070.001,Clear Windows Event Logs,1,Clear Logs,e6abb60e-26b8-41da-8aae-0c35174b0967,command_prompt -defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLogId,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell +defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLog,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell defense-evasion,T1027.004,Compile After Delivery,1,Compile After Delivery using csc.exe,ffcdbd6a-b0e8-487d-927a-09127fe9a206,command_prompt defense-evasion,T1027.004,Compile After Delivery,2,Dynamic C# Compile,453614d8-3ba6-4147-acc0-7ec4b3e1faef,powershell defense-evasion,T1218.001,Compiled HTML File,1,Compiled HTML Help Local Payload,5cb87818-0d7c-4469-b7ef-9224107aebe8,command_prompt diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv index 9ab36240..d881efb0 100644 --- a/atomics/Indexes/Indexes-CSV/windows-index.csv +++ b/atomics/Indexes/Indexes-CSV/windows-index.csv @@ -66,7 +66,7 @@ defense-evasion,T1548.002,Bypass User Access Control,7,Bypass UAC using sdclt De defense-evasion,T1218.003,CMSTP,1,CMSTP Executing Remote Scriptlet,34e63321-9683-496b-bbc1-7566bc55e624,command_prompt defense-evasion,T1218.003,CMSTP,2,CMSTP Executing UAC Bypass,748cb4f6-2fb3-4e97-b7ad-b22635a09ab0,command_prompt defense-evasion,T1070.001,Clear Windows Event Logs,1,Clear Logs,e6abb60e-26b8-41da-8aae-0c35174b0967,command_prompt -defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLogId,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell +defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLog,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell defense-evasion,T1027.004,Compile After Delivery,1,Compile After Delivery using csc.exe,ffcdbd6a-b0e8-487d-927a-09127fe9a206,command_prompt defense-evasion,T1027.004,Compile After Delivery,2,Dynamic C# Compile,453614d8-3ba6-4147-acc0-7ec4b3e1faef,powershell defense-evasion,T1218.001,Compiled HTML File,1,Compiled HTML Help Local Payload,5cb87818-0d7c-4469-b7ef-9224107aebe8,command_prompt diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md index eb50dbc3..f11b7a56 100644 --- a/atomics/Indexes/Indexes-Markdown/index.md +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -481,7 +481,7 @@ - Atomic Test #3: Overwrite Linux Log [linux] - [T1070.001 Clear Windows Event Logs](../../T1070.001/T1070.001.md) - Atomic Test #1: Clear Logs [windows] - - Atomic Test #2: Delete System Logs Using Clear-EventLogId [windows] + - Atomic Test #2: Delete System Logs Using Clear-EventLog [windows] - T1078.004 Cloud Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1553.002 Code Signing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - [T1027.004 Compile After Delivery](../../T1027.004/T1027.004.md) diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md index dfd05146..1535d2fc 100644 --- a/atomics/Indexes/Indexes-Markdown/windows-index.md +++ b/atomics/Indexes/Indexes-Markdown/windows-index.md @@ -142,7 +142,7 @@ - T1574.012 COR_PROFILER [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - [T1070.001 Clear Windows Event Logs](../../T1070.001/T1070.001.md) - Atomic Test #1: Clear Logs [windows] - - Atomic Test #2: Delete System Logs Using Clear-EventLogId [windows] + - Atomic Test #2: Delete System Logs Using Clear-EventLog [windows] - T1553.002 Code Signing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - [T1027.004 Compile After Delivery](../../T1027.004/T1027.004.md) - Atomic Test #1: Compile After Delivery using csc.exe [windows] diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 1d387288..ac1e26ae 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -22296,17 +22296,19 @@ defense-evasion: ' name: command_prompt elevation_required: true - - name: Delete System Logs Using Clear-EventLogId + - name: Delete System Logs Using Clear-EventLog auto_generated_guid: b13e9306-3351-4b4b-a6e8-477358b0b498 description: | Clear event logs using built-in PowerShell commands. + Upon successful execution, you should see the list of deleted event logs Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty or has very few logs in it. supported_platforms: - windows executor: - command: 'Clear-EventLog -logname Application - -' + command: | + $logs = Get-EventLog -List | ForEach-Object {$_.Log} + $logs | ForEach-Object {Clear-EventLog -LogName $_ } + Get-EventLog -list name: powershell elevation_required: true T1078.004: diff --git a/atomics/T1070.001/T1070.001.md b/atomics/T1070.001/T1070.001.md index 98a42e48..02958f4f 100644 --- a/atomics/T1070.001/T1070.001.md +++ b/atomics/T1070.001/T1070.001.md @@ -14,7 +14,7 @@ These logs may also be cleared through other mechanisms, such as the event viewe - [Atomic Test #1 - Clear Logs](#atomic-test-1---clear-logs) -- [Atomic Test #2 - Delete System Logs Using Clear-EventLogId](#atomic-test-2---delete-system-logs-using-clear-eventlogid) +- [Atomic Test #2 - Delete System Logs Using Clear-EventLog](#atomic-test-2---delete-system-logs-using-clear-eventlog)
@@ -48,8 +48,9 @@ wevtutil cl #{log_name}

-## Atomic Test #2 - Delete System Logs Using Clear-EventLogId +## Atomic Test #2 - Delete System Logs Using Clear-EventLog Clear event logs using built-in PowerShell commands. +Upon successful execution, you should see the list of deleted event logs Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty or has very few logs in it. **Supported Platforms:** Windows @@ -62,7 +63,9 @@ Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs a ```powershell -Clear-EventLog -logname Application +$logs = Get-EventLog -List | ForEach-Object {$_.Log} +$logs | ForEach-Object {Clear-EventLog -LogName $_ } +Get-EventLog -list ```