Skip to content

Clear Windows Event Logs

Subtechnique · ATTACK:enterprise:T1685.005

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1685.005",
  "title": "Clear Windows Event Logs",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1685/005",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--75b9a4d2-d4e2-4ca1-9aab-1badd9e05fd0",
  "external_id": "T1685.005",
  "domain": "enterprise",
  "created": "2026-04-14T22:54:03.796Z",
  "modified": "2026-05-12T15:12:00.642Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "defense-impairment"
  ],
  "source_references": [
    {
      "source_name": "disable_win_evt_logging",
      "url": "https://ptylu.github.io/content/report/report.html?report=25"
    }
  ]
}

Explicit source assertions (47)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1133 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--035ad845-9a13-41bb-b7c1-1bd47d787605

SentinelOne Agrius 2021

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ed4dd7a-2e60-4c3e-b70b-5c30f2c28ad6

Microsoft BlackCat Jun 2022

ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18d8109f-d3da-4cc8-9414-3e399f206d04

Microsoft FinFisher March 2018 · FinFisher Citation

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--201a9d42-beef-4cab-866a-0e045d83eb21

ESEST Black Energy Jan 2016

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d66a88f-f50e-4749-aa17-6c4b1f552648

SentinelLabs Metador Sept 2022

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c7e4671-97ef-4822-b0dd-a8288b1c6735

JPCERT MirrorFace JUL 2024

ATTACK:enterprise:S0688 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cfabaa7-ee34-4299-939d-66530d7bce62

Check Point Meteor Aug 2021

ATTACK:enterprise:S1135 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41281da3-2cdf-4b6c-a65d-622856fa0258

Unit42 Agrius 2023

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41735c38-950d-4c69-8c01-c076d3a4e409

FireEye Hacking Team · Gh0stRAT ATT March 2019

ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4193ee99-a77c-47c7-97a4-7d3f3917242d

ESET MirrorFace 2025

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48145882-7f08-49a1-be48-7b5b0d2f4c8c

FireEye APT41 Aug 2019

ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b8cf760-9566-4fd2-8cd4-62832fb6d254

Talos Nyetya June 2017 · US District Court Indictment GRU Unit 74455 October 2020

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--563e5c4d-0ff6-44ac-858b-37c2927589f6

Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d9e27b1-3e1d-46df-9d01-c925789206fa

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:M1029 → mitigates → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60af1190-aec3-44d3-9c59-fb12df469d00

ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64998237-28a6-42ca-8ea5-d6bbfa9f8489

Kaspersky ShrinkLocker 2024

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65e74662-fe4a-4eaa-a603-cc3fceafb811

FireEye APT38 Oct 2018

ATTACK:enterprise:S0698 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6889ac3a-22eb-4ea1-a6e4-56d8cd064b76

ESET Hermetic Wizard March 2022

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6eb9c742-7eab-4eef-9036-d9af96dbafb4

Sophos Qilin MSP APR 2025 · Halcyon Qilin.B OCT 2024

ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6eded7c7-8c55-4ced-83ad-f19f1b885af5

Talos Olympic Destroyer 2018

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73ba3a26-5a77-4c3a-aea7-5ea8de846b75

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--759f675c-2172-4dcd-b781-571e9577a921

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:T1685.005 → subtechnique-of → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--760c9e3c-6074-442a-bf16-39e0fa82919b

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77d6442b-5730-4a3b-a3bb-f86054dd8402

ESEST Black Energy Jan 2016

ATTACK:enterprise:G0053 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--786e00b6-1699-49ab-88a9-c174ecbd4c41

Mandiant FIN5 GrrCON Oct 2016

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bbaad80-c511-4449-85ad-4c9a8fd9f847

NCC Group Chimera January 2021

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f4bb217-3a93-40bc-b15b-acb2e121ddf7

US-CERT TA18-074A

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f746c17-946d-46c9-a2fe-7155b468f14e

FoxIT Wocao December 2019

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bfd8a04-63b1-4c2f-a6ba-adc67ab87154

Cybereason Lockbit 2.0 · Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022 · SentinelOne LockBit 2.0

ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8fdfaa48-8004-4b46-a5f6-a5f6a1bac593

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--952fa0ae-6cc0-4cbd-9a25-6902a745ef63

Group-IB RansomHub FEB 2025

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a97899ea-2470-4612-ab5e-2637556da1cb

FireEye Know Your Enemy FIN8 Aug 2016

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac9b186f-dfd1-4110-b53e-299652097280

Mandiant_UNC2165 · Symantec WastedLocker June 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aede5fa1-59de-40bf-92ca-15e317246f2d

FireEye APT32 May 2017

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aee6f237-3565-4284-b887-0703f28022d8

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S0253 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c07f4012-d5dc-4039-9d5c-7487c501188f

McAfee Gold Dragon

ATTACK:enterprise:S0645 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1f1c1a4-858d-45a8-a7e6-7d9715a951d4

Wevtutil Microsoft Documentation · Crowdstrike DNC June 2016

ATTACK:enterprise:S0242 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c430c59d-5998-4c8d-88de-4a05175197ff

SecureList SynAck Doppelgänging May 2018

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7d647d2-25fb-477a-9585-e6a352f367af

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7fa894b-a6b9-47ba-83d4-596791518ba9

ESET Hermetic Wizard March 2022

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb5b8564-d019-4134-8214-87d766128e1b

Unit 42 Lucifer June 2020

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc8cfe3a-ae1b-4827-adde-bd7412064b16

Google Cloud APT41 2024

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dcc70c82-d2b2-4046-81e2-8afc0b2a6182

Crowdstrike DNC June 2016 · DOJ GRU Indictment Jul 2018

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddefe661-bfca-47ad-aa9c-3edb0b6f510a

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de96f11c-1e26-4438-8332-9b4ab4fa6cde

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5c8f8fd-2231-4d95-be4d-3757a4592907

Microsoft Silk Typhoon MAR 2025

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef66842b-7f2f-411d-810e-c67d4372fbb9

Talos ZxShell Oct 2014

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.