Hackers Exploited Windows Event Logs Tool log Manipulation, And Data Exfiltration

This report explains how attackers abuse the Windows wevtutil.exe tool as a LOLBAS technique to clear, query, and export event logs, enabling defense evasion and potential data exfiltration. It highlights operational details and artifacts—such as the need for elevated privileges, the generation of Event ID 1102 when clearing the Security log, and lack of native logging for non-Security log clearing—while noting that selective clearing of individual events is not possible. Recommended defenses include enabling relevant audit policies (e.g., “Audit Other Object Access Events”), enforcing strict access controls on event logs, enhancing behavioral monitoring, and flagging suspicious toolchains that combine wevtutil.exe with utilities like makecab.exe and certutil.exe.