diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv
index 381b61bc..b2c523d5 100644
--- a/atomics/Indexes/Indexes-CSV/index.csv
+++ b/atomics/Indexes/Indexes-CSV/index.csv
@@ -231,7 +231,7 @@ defense-evasion,T1070.002,Clear Linux or Mac System Logs,1,rm -rf,989cc1b1-3642-
defense-evasion,T1070.002,Clear Linux or Mac System Logs,2,Overwrite Linux Mail Spool,1602ff76-ed7f-4c94-b550-2f727b4782d4,bash
defense-evasion,T1070.002,Clear Linux or Mac System Logs,3,Overwrite Linux Log,d304b2dc-90b4-4465-a650-16ddd503f7b5,bash
defense-evasion,T1070.001,Clear Windows Event Logs,1,Clear Logs,e6abb60e-26b8-41da-8aae-0c35174b0967,command_prompt
-defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLogId,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell
+defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLog,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell
defense-evasion,T1027.004,Compile After Delivery,1,Compile After Delivery using csc.exe,ffcdbd6a-b0e8-487d-927a-09127fe9a206,command_prompt
defense-evasion,T1027.004,Compile After Delivery,2,Dynamic C# Compile,453614d8-3ba6-4147-acc0-7ec4b3e1faef,powershell
defense-evasion,T1218.001,Compiled HTML File,1,Compiled HTML Help Local Payload,5cb87818-0d7c-4469-b7ef-9224107aebe8,command_prompt
diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv
index 9ab36240..d881efb0 100644
--- a/atomics/Indexes/Indexes-CSV/windows-index.csv
+++ b/atomics/Indexes/Indexes-CSV/windows-index.csv
@@ -66,7 +66,7 @@ defense-evasion,T1548.002,Bypass User Access Control,7,Bypass UAC using sdclt De
defense-evasion,T1218.003,CMSTP,1,CMSTP Executing Remote Scriptlet,34e63321-9683-496b-bbc1-7566bc55e624,command_prompt
defense-evasion,T1218.003,CMSTP,2,CMSTP Executing UAC Bypass,748cb4f6-2fb3-4e97-b7ad-b22635a09ab0,command_prompt
defense-evasion,T1070.001,Clear Windows Event Logs,1,Clear Logs,e6abb60e-26b8-41da-8aae-0c35174b0967,command_prompt
-defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLogId,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell
+defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLog,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell
defense-evasion,T1027.004,Compile After Delivery,1,Compile After Delivery using csc.exe,ffcdbd6a-b0e8-487d-927a-09127fe9a206,command_prompt
defense-evasion,T1027.004,Compile After Delivery,2,Dynamic C# Compile,453614d8-3ba6-4147-acc0-7ec4b3e1faef,powershell
defense-evasion,T1218.001,Compiled HTML File,1,Compiled HTML Help Local Payload,5cb87818-0d7c-4469-b7ef-9224107aebe8,command_prompt
diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md
index eb50dbc3..f11b7a56 100644
--- a/atomics/Indexes/Indexes-Markdown/index.md
+++ b/atomics/Indexes/Indexes-Markdown/index.md
@@ -481,7 +481,7 @@
- Atomic Test #3: Overwrite Linux Log [linux]
- [T1070.001 Clear Windows Event Logs](../../T1070.001/T1070.001.md)
- Atomic Test #1: Clear Logs [windows]
- - Atomic Test #2: Delete System Logs Using Clear-EventLogId [windows]
+ - Atomic Test #2: Delete System Logs Using Clear-EventLog [windows]
- T1078.004 Cloud Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1553.002 Code Signing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1027.004 Compile After Delivery](../../T1027.004/T1027.004.md)
diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md
index dfd05146..1535d2fc 100644
--- a/atomics/Indexes/Indexes-Markdown/windows-index.md
+++ b/atomics/Indexes/Indexes-Markdown/windows-index.md
@@ -142,7 +142,7 @@
- T1574.012 COR_PROFILER [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1070.001 Clear Windows Event Logs](../../T1070.001/T1070.001.md)
- Atomic Test #1: Clear Logs [windows]
- - Atomic Test #2: Delete System Logs Using Clear-EventLogId [windows]
+ - Atomic Test #2: Delete System Logs Using Clear-EventLog [windows]
- T1553.002 Code Signing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1027.004 Compile After Delivery](../../T1027.004/T1027.004.md)
- Atomic Test #1: Compile After Delivery using csc.exe [windows]
diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml
index 1d387288..ac1e26ae 100644
--- a/atomics/Indexes/index.yaml
+++ b/atomics/Indexes/index.yaml
@@ -22296,17 +22296,19 @@ defense-evasion:
'
name: command_prompt
elevation_required: true
- - name: Delete System Logs Using Clear-EventLogId
+ - name: Delete System Logs Using Clear-EventLog
auto_generated_guid: b13e9306-3351-4b4b-a6e8-477358b0b498
description: |
Clear event logs using built-in PowerShell commands.
+ Upon successful execution, you should see the list of deleted event logs
Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty or has very few logs in it.
supported_platforms:
- windows
executor:
- command: 'Clear-EventLog -logname Application
-
-'
+ command: |
+ $logs = Get-EventLog -List | ForEach-Object {$_.Log}
+ $logs | ForEach-Object {Clear-EventLog -LogName $_ }
+ Get-EventLog -list
name: powershell
elevation_required: true
T1078.004:
diff --git a/atomics/T1070.001/T1070.001.md b/atomics/T1070.001/T1070.001.md
index 98a42e48..02958f4f 100644
--- a/atomics/T1070.001/T1070.001.md
+++ b/atomics/T1070.001/T1070.001.md
@@ -14,7 +14,7 @@ These logs may also be cleared through other mechanisms, such as the event viewe
- [Atomic Test #1 - Clear Logs](#atomic-test-1---clear-logs)
-- [Atomic Test #2 - Delete System Logs Using Clear-EventLogId](#atomic-test-2---delete-system-logs-using-clear-eventlogid)
+- [Atomic Test #2 - Delete System Logs Using Clear-EventLog](#atomic-test-2---delete-system-logs-using-clear-eventlog)
@@ -48,8 +48,9 @@ wevtutil cl #{log_name}
-## Atomic Test #2 - Delete System Logs Using Clear-EventLogId
+## Atomic Test #2 - Delete System Logs Using Clear-EventLog
Clear event logs using built-in PowerShell commands.
+Upon successful execution, you should see the list of deleted event logs
Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty or has very few logs in it.
**Supported Platforms:** Windows
@@ -62,7 +63,9 @@ Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs a
```powershell
-Clear-EventLog -logname Application
+$logs = Get-EventLog -List | ForEach-Object {$_.Log}
+$logs | ForEach-Object {Clear-EventLog -LogName $_ }
+Get-EventLog -list
```