value:  FIN5 has cleared event logs from victims. ;; FIN8 has cleared logs during post compromise cleanup activities. ;; FinFisher clears the system event logs using OpenEventLog/ClearEventLog APIs . ;; gh0st RAT is able to wipe event logs. ;; Hydraq creates a backdoor through which remote attackers can clear all system event logs. ;; Lucifer can clear and remove event logs. ;; NotPetya uses wevtutil to clear the Windows event logs. ;; Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil. ;; Operation Wocao has deleted Windows Event Logs to hinder forensic investigation. ;; Pupy has a module to clear event logs with PowerShell. ;; RunningRAT contains code to clear event logs. ;; SynAck clears event logs. ;; ZxShell has a command to clear system event logs.
name: Indicator Removal on Host: Clear Windows Event Logs