From 9c86fbef426e5906b777feaf2b1fd37f21c29a11 Mon Sep 17 00:00:00 2001
From: Elad Levi <99.elad.levi@gmail.com>
Date: Sat, 22 Feb 2025 21:41:02 +0200
Subject: [PATCH] Clearing Event Log with wevtapi functions (#1006)

* Added related wevtapi functions

* Update clear-windows-event-logs.yml

* Update clear-windows-event-logs.yml

* Create clear-windows-event-logs-remotely.yml

* Update clear-windows-event-logs-remotely.yml

* Update clear-windows-event-logs-remotely.yml

* Update clear-windows-event-logs-remotely.yml

* Revert "Update clear-windows-event-logs-remotely.yml"

This reverts commit 97b573009e86e21677a059a700b75f3b7b58228b.

* Update clear-windows-event-logs-remotely.yml

* Update clear-windows-event-logs-remotely.yml

---------

Co-authored-by: Elad Levi <getelmusic@gmail.com>
---
 .../clear-windows-event-logs-remotely.yml     | 20 +++++++++++++++++++
 .../clear-logs/clear-windows-event-logs.yml   |  3 +++
 2 files changed, 23 insertions(+)
 create mode 100644 anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs-remotely.yml

diff --git a/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs-remotely.yml b/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs-remotely.yml
new file mode 100644
index 00000000..efafc319
--- /dev/null
+++ b/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs-remotely.yml
@@ -0,0 +1,20 @@
+rule:
+  meta:
+    name: clear Windows event logs remotely
+    namespace: anti-analysis/anti-forensic/clear-logs
+    authors:
+      - 99.elad.levi@gmail.com
+    scopes:
+      static: function
+      dynamic: span of calls
+    att&ck:
+      - Defense Evasion::Indicator Removal::Clear Windows Event Logs [T1070.001]
+    references:
+      - https://github.com/getel-arch/ClearLogsRemotely
+    examples:
+      - 4f509bdfe5a2fe4320cdc070eedc0a72e12cc08f43d60a7701305b3d1408102b:0x1400014de
+  features:
+    - and:
+      - api: wevtapi.EvtOpenSession
+      - api: wevtapi.EvtOpenLog
+      - api: wevtapi.EvtClearLog
diff --git a/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml b/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
index d490ea14..d35238a5 100644
--- a/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
+++ b/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
@@ -20,9 +20,12 @@ rule:
           - or:
             - api: advapi32.ElfClearEventLogFile
             - api: advapi32.ClearEventLog
+            - api: wevtapi.EvtClearLog
           - optional:
             - api: advapi32.OpenEventLog
             - api: advapi32.GetNumberOfEventLogRecords
+            - api: wevtapi.EvtOpenLog
+            - api: wevtapi.EvtOpenSession
         - basic block:
           - and:
             - string: /wevtutil(\.exe)?\s+(clear-log|cl)/i