Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog

 1title: Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog
 2id: d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b
 3status: test
 4description: |
 5    Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method.
 6    Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated
 7    when the WMI operation encounters an error (e.g. access denied, provider failure).
 8    It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues.
 9    Successful clearing operations will NOT produce this event; for those, correlate with
10    Security event 1102 or System event 104.    
11references:
12    - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/cleareventlog-method-in-class-win32-nteventlogfile
13author: Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2026-07-01
15tags:
16    - attack.defense-impairment
17    - attack.t1685.005
18logsource:
19    product: windows
20    service: wmi
21detection:
22    selection:
23        EventID: 5858
24        Operation|contains|all:
25            - 'Win32_NTEventlogFile'
26            - 'cleareventlog'
27    condition: selection
28falsepositives:
29    - Unknown
30level: medium
31regression_tests_path: regression_data/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog/info.yml