[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2020/11/30"

[rule]
author = ["Elastic"]
description = """
Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by
attackers in an attempt to evade detection or destroy forensic evidence on a system.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*"]
language = "kuery"
license = "Elastic License"
name = "Clearing Windows Event Logs"
risk_score = 21
rule_id = "d331bbe2-6db4-4941-80a5-8270db72eb61"
severity = "low"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Defense Evasion"]
type = "query"

query = '''
event.category:process and event.type:(process_started or start) and 
(process.name:"wevtutil.exe" or process.pe.original_file_name:"wevtutil.exe") and 
process.args:("/e:false" or cl or "clear-log") or process.name:"powershell.exe" and process.args:"Clear-EventLog"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal on Host"
reference = "https://attack.mitre.org/techniques/T1070/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
