The built-in event log utility clears (empties) a named Windows Event Log channel with the cl / clear-log verb, destroying recorded evidence. An optional /bu: switch backs the log up first; adversaries omit it.
Use Erase Security/System/Application logs after intrusion activity to remove indicators of compromise.
Detection: Alert on Security Event ID 1102 (audit log cleared) and System 104 (log file cleared). Log process creation (Sysmon 1 / Security 4688) for wevtutil.exe with 'cl' or 'clear-log' arguments; forward events to a SIEM so cleared local copies still survive centrally.
Verified
✓ MS Learn wevtutil doc confirms 'cl|clear-log <Logname> [/bu:<Backup>]' clears a log (docs example: wevtutil cl Application /bu:...); maps to ATT&CK T1070.001. No change.
The set-log (sl) verb with /e:false disables a Windows Event Log channel so future events for that channel are no longer written, blinding defenders without clearing existing entries.
Use Disable Security or PowerShell operational channels before running noisy tooling so nothing is recorded.
Detection: Monitor process creation (Sysmon 1 / 4688) for wevtutil.exe with 'sl' plus '/e:false'. Watch Event ID 1100/1102/4719 (audit policy or log service state change) and alert on any channel being disabled, especially Security, System, and Microsoft-Windows-PowerShell/Operational.
Verified
✓ MS Learn wevtutil doc confirms 'sl|set-log' with '/e:<Enabled>' where Enabled is true or false ('Enables or disables a log'); primary ATT&CK ID T1562.002 is accurate (T1070.001 is a related secondary tag). No change.