įIN8 has cleared logs during post compromise cleanup activities. įIN5 has cleared event logs from victims.
The actors also deleted specific Registry keys. ĭragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. Ĭhimera has cleared event logs on compromised hosts. The BlackEnergy component KillDisk is capable of deleting Windows Event Logs. ĪPT41 attempted to remove evidence of some of its activity by clearing Windows security and system events. ĪPT38 clears Window Event logs and Sysmon logs from the system. ĪPT32 has cleared select event log entries. APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.
