ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™
  • ID: AF002.001
  • Created: 25th May 2024
  • Updated: 23rd October 2025
  • Platform: Windows
  • MITRE ATT&CK®: T1070.001T1070
  • Contributor: The ITM Team

Clear Windows Event Logs

A subject clears Windows Event logs to conceal evidence of their activities.

Windows Event Logs store various types of information, such as system errors, application events, security auditing messages, and other operational events.

The logs are stored in C:/WINDOWS/system32/config.

Windows Event Logs can be cleared using the Event Viewer utility, provided the user account has administrative privileges.