Wevtutil S0645

Type: tool
Platform: Windows
Created: 14 September 2021
Last modified: 12 May 2026

Wevtutil is a Windows command-line utility that enables administrators to retrieve information about event logs and publishers.[1]

TechniquesBottom 12%

TacticsBottom 12%

Threat groupsunranked

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Wevtutil MITRE reference S0645

Data from Local System T1005 ↗

Wevtutil can be used to export events from a specific log.2 3

Collection22 detection rules

Disable or Modify Windows Event Log T1685.001 ↗

Wevtutil can be used to disable specific event logs on the system.4

Defense Impairment41 detection rules

Clear Windows Event Logs T1685.005 ↗

Wevtutil can be used to clear system and security event logs from the system.5 6

Defense Impairment14 detection rules

Standing S0645

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques3Bottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics2Bottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more tactics spanned.

Threat groups661% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaign185% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique22med53rd pct

53rd percentile · 53% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique4med

Wevtutil detections S0645

76 distinct rules cover the 3 techniques recorded for this tool. 50 Sigma · 26 Splunk.

3 covered by at least one rule76 distinct rules in total

Showing 1-50 of 76 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
	Threat actors can use auditpol binary to change audit policy configuration to impair detection capability. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	high	Janantha Marasinghe (https://github.com/blueteam0ps)	2021-02-02	2023-02-22	0a13e132-651d-11eb-ae93-0242ac130002
	Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	high	Nasreddine Bencherchali (Nextron Systems)	2021-12-18	2023-02-21	c6c56ada-612b-42d1-9a29-adad3c5c2c1e
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
	Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	high	frack113	2022-09-17	2024-03-25	7d9263bd-dc47-4a58-bc92-5474abab390c
Splunk	This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Cloud Storage Collection Data from Local System	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
Splunk	This analytic detects suppression of specific logging messages on Cisco ASA devices using the "no logging message" command. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Stealth Indicator Removal	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	4e6c9d2a-8f3b-4c7e-9a5f-2d8b6e1c4a9f
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
Splunk	This analytic detects Cisco IOS-XE command sequences where show logging, clear logging, and exit occur within a short period. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Defense Impairment Disable or Modify Tools Clear Windows Event Logs	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	e20a6709-5f2c-4508-83fb-b3af6f705717
Splunk	This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...)	Generic	stable	configuration_change	-	Cisco IOS · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Web Service	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	1abce487-f480-4d5f-a551-01de0bece0bd
	Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.	Generic	experimental	-	windows	WinEventLog System	Collection Data from Local System Credential Access OS Credential Dumping Security Account Manager	-	medium	Jason Mull	2025-05-12	—	882fbe50-d8d7-4e29-ae80-0648a8556866
Splunk	The following analytic detects the execution of "wevtutil.exe" with parameters to disable event logs. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Defense Impairment Disable or Modify Tools Clear Windows Event Logs	-	medium	Teoderick Contreras, Splunk	2021-06-10	2026-10-02	236e7c8e-c9d9-11eb-a824-acde48001122
	Detects the addition of a key 'MiniNt' to the registry. (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Defense Impairment Modify Registry	-	high	Ilyas Ochkov, oscd.community	2019-10-25	2021-11-27	919f2ef0-be2d-4a7a-b635-eb2b41fde044
	Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows e (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	high	frack113, Nasreddine Bencherchali (Nextron Systems)	2022-07-04	2024-03-25	2f78da12-f7c7-430b-8b19-a28f269b77a3
	Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	high	frack113	2022-01-09	2023-01-22	e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e
	One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and M (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Local System	-	medium	frack113	2022-02-13	2024-03-05	6a69f62d-ce75-4b57-8dce-6351eb55b362
Splunk	This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Collection Data from Local System Credential Access OS Credential Dumping /etc/passwd and /etc/shadow	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	6fa0073d-6ca0-4f93-913d-fb420c9de15b	-
Splunk	This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Collection Data from Local System	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	2e155547-aaac-49d3-b0ef-ceabc31fd364	-
	Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.	Generic	test	-	windows	IIS	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence Server Software Component IIS Components	-	medium	frack113, Nasreddine Bencherchali	2024-10-06	—	a5b40a90-baf5-4bf7-a6f7-373494881d22
	One of the Windows Eventlogs has been cleared. (...)	Generic	test	host_status	windows	WinEventLog System	Defense Impairment Disable or Modify Tools Clear Windows Event Logs	-	medium	Florian Roth (Nextron Systems)	2017-01-10	2023-11-15	a62b37e0-45d3-48d9-a517-90c1a1b0186b
	Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. (...)	Generic	test	file_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	medium	D3F7A5105	2023-01-02	2026-10-13	65236ec7-ace0-4f0c-82fd-737b04fd4dcb
	Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method. (...)	Generic	test	-	windows	WMI	Defense Impairment Disable or Modify Tools Clear Windows Event Logs	-	medium	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-07-01	—	d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b
	Detect filter driver unloading activity via fltmc.exe	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Stealth Indicator Removal	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-02-13	2025-10-07	4931188c-178e-4ee7-a348-39e8a7a56821
	Detects the creation of specific files inside of ProgramData directory. (...)	Emerging	test	file_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	2024-07-11	b92d1d19-f5c9-4ed6-bbd5-7476709dc389
	Detects the creation of JavaScript files inside of the DriverStore directory. (...)	Emerging	test	file_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	CVE-2022-38028	medium	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	ec7c4e9b-9bc9-47c7-a32f-b53b598da642
	Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the W (...)	Generic	test	image_load	windows	Sysmon	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	high	Florian Roth (Nextron Systems)	2022-09-07	2024-11-23	49329257-089d-46e6-af37-4afce4290685
	Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	high	Florian Roth (Nextron Systems)	2022-09-07	2023-02-14	bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c
	Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon	Generic	test	process_access	windows	Sysmon	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	high	Florian Roth (Nextron Systems)	2022-09-07	2026-06-29	d29ada0f-af45-4f27-8f32-f7b77c3dbc4e
	Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.	Generic	test	-	windows	IIS	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence Server Software Component IIS Components	-	high	frack113	2024-10-06	—	e8ebd53a-30c2-45bd-81bb-74befba07bdb
	Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.	Generic	test	configuration_change	windows	WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-20	2023-11-17	ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1
	Detects the clearing of one of the Windows Core Eventlogs. (...)	Generic	test	host_status	windows	WinEventLog System	Defense Impairment Disable or Modify Tools Clear Windows Event Logs	-	high	Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)	2022-05-17	2023-11-15	100ef69e-3327-481c-8e5c-6d80d9507556
	Detects the addition of a new module to an IIS server.	Generic	test	-	windows	IIS	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence Server Software Component IIS Components	-	medium	frack113	2024-10-06	—	dd857d3e-0c6e-457b-9b48-e82ae7f86bd7
	Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main mo (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Clear Windows Event Logs Credential Access OS Credential Dumping LSASS Memory Stealth System Binary Proxy Execution Rundll32	-	critical	Florian Roth (Nextron Systems), Tom Ueltschi	2019-01-16	2022-12-15	79aeeb41-8156-4fac-a0cd-076495ab82a1
	Detects instances where an SMB service on an OpenCanary node has had a file open request.	Generic	test	-	-	OpenCanary	Collection Data from Local System Lateral Movement Remote Services	-	high	Security Onion Solutions	2024-03-08	—	22777c9e-873a-4b49-855f-6072ab861a52
	Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-08-01	2025-12-26	f37b4bce-49d0-4087-9f5b-58bffda77316
	Detects a command used by conti to dump database	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Local System	-	high	frack113	2021-08-16	2023-05-04	2f47f1fd-0901-466e-a770-3b7092834a1b
	Detects tampering with EventLog service "file" key. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log	-	high	D3F7A5105	2023-01-02	2023-08-17	0cb8d736-995d-4ce7-a31e-1e8d452a1459
	This rule detects potential exfiltration by looking for a few compression extensions in the uri and (...)	Unsupported	unsupported	-	-	HTTP · Zeek	Collection Archive Collected Data Archive via Utility Collection Data from Local System	-	medium	Greg Howell, OTR (Open Threat Research)	2020-04-05	2023-03-24	0d47e3f6-357f-4534-928c-202631d065fa
	Detects potential suspicious behaviour using secedit.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Authentication Package Port Monitors Active Setup Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL Accessibility Features Stealth Hide Artifacts Hidden Users Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable Persistence, Defense Impairment, Credential Access Modify Authentication Process Password Filter DLL Persistence Server Software Component Terminal Services DLL Discovery System Information Discovery	-	medium	Janantha Marasinghe	2022-11-18	2022-12-30	c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
	Detects the removal of a previously installed IIS module.	Generic	test	-	windows	IIS	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence Server Software Component IIS Components	-	low	Nasreddine Bencherchali	2024-10-06	—	9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f
Splunk	This analytic detects Windchill MethodServer log4j events showing suspicious `c=` command execution or `p=` file read parameters sent to Windchill gateway paths associated with CVE-2026-4681 exploitation. (...)	Anomaly	stable	network_connection	-	Windchill Log4j	Execution Command and Scripting Interpreter Collection Data from Local System Initial Access Exploit Public-Facing Application	CVE-2026-4681	medium	Nasreddine Bencherchali, Splunk	2026-06-14	2026-06-14	d725b390-fe86-47df-b9a1-57497915403e
	Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). (...)	Generic	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Collection Data from Local System Credential Access Unsecured Credentials	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-25	—	f0025a69-e1b7-4dda-a53c-db21fa2d4071
	Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Collection Data from Local System Credential Access Unsecured Credentials	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-25	—	0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
	Detects attempts to disable security event logging by adding the `MiniNt` registry key. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Defense Impairment Modify Registry	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-04-09	—	1a4bd6af-99ac-4466-b5b2-7b72b4a05462
	Detects the addition of the 'MiniNt' key to the registry. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Defense Impairment Modify Registry	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-04-09	—	8839e550-52d7-4958-9f2f-e13c1e736838
	One of the Windows Eventlogs has been cleared. (...)	Generic	test	-	windows	WinEventLog Security	Defense Impairment Disable or Modify Tools Clear Windows Event Logs	-	high	Florian Roth (Nextron Systems)	2017-01-10	2022-02-24	d99b79d2-0a6f-4f46-ad8b-260b6e17f982
	Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.	Emerging	experimental	process_creation	linux	Sysmon	Collection Data from Local System Exfiltration Exfiltration Over C2 Channel	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-09-24	—	efd2eb09-b72e-4a61-8dc7-b1382a1e8983
	Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers Collection Data from Local System Credential Access Steal Web Session Cookie	-	high	TropChaud	2022-12-19	2023-01-19	24c77512-782b-448a-8950-eddb0785fc71
	Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Local System Credential Access Steal Web Session Cookie	-	high	frack113	2022-04-08	2023-01-19	4833155a-4053-4c9c-a997-777fcea0baa7