Clearing an event log

evasion_event_log_clear

Clears the Windows Application event log, which is the anti-forensic step that follows a successful intrusion and raises event 1102. This cannot be undone, so it needs --allow-irreversible as well as consent. The Security log is deliberately left alone so the SOC keeps the evidence of this run.

Severity high how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 1 Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

--i-understand
Needs explicit consent: this test changes machine state or fetches real offensive tooling.
--allow-irreversible
Cannot be undone. Consent alone is not enough, because "this machine is disposable" and "destroy the evidence of this run" are different decisions.
wants admin
Only fully works with administrative rights. It still runs without them — the refusal is itself informative — and the report says which it was.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1070.001	Clear Windows Event Logs	Defense Evasion	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other defence evasion tests

Other tests in the Defence evasion category.
Test	What it does	Severity
Adding a Defender exclusion path evasion_defender_exclusion	Adds the sandbox directory to Microsoft Defender's exclusion list, verifies whether it took effect, and removes it again. Adding an exclusion is how c…	critical
Disabling Defender real-time monitoring evasion_defender_realtime_disable	Attempts to turn off Microsoft Defender's real-time monitoring through Set-MpPreference and turns it back on again. With tamper protection enabled thi…	critical
Stopping security services evasion_security_service_stop	Identifies which EDR/AV/telemetry services are actually running on this host and attempts to stop up to three of them, then restarts them. Tamper prot…	critical
In-memory AMSI bypass attempt evasion_amsi_bypass_attempt	Runs the published AMSI bypass one-liner in PowerShell and then feeds AMSI's own test string through Invoke-Expression, to establish whether script sc…	high
Disabling the host firewall evasion_firewall_disable	Turns the host firewall off and immediately back on, using the platform's own tool (netsh advfirewall, socketfilterfw, ufw or firewalld). The re-enabl…	high
Timestomping a file evasion_timestomp	Backdates the modification and access times of a sandbox file to 2009 and verifies the change, the standard anti-forensic step for making a dropped fi…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.