Threadlinqs IntelligenceStart free

ATT&CK techniqueDefense Impairment

T1685.005 Clear Windows Event Logs

Defense ImpairmentEnterpriseSub-technique

As of 2026-10-05, T1685.005 (Clear Windows Event Logs) appears in 41 tracked threats, first reported 2026-02-02 and most recently 2026-10-01, with linked actors including The Gentlemen, VECT, ALPHV; it most often appears alongside T1059.001 (PowerShell).

Tracked threats
4111 critical, 25 high, 5 medium
First seen
2026-02-02
Last seen
2026-10-01
Threat actors
21In the threats using it
Detection rules
—None mapped yet

Data as of:

Activity timeline

T1685.005 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 19 reports, and 41 of the 41 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1685.005 Clear Windows Event Logs is catalogued by MITRE ATT&CK under the Defense Impairment tactic in the Enterprise matrix, as a sub-technique of T1685 Disable or Modify Tools. Threadlinqs maps 41 of 2623 tracked threats (1.6%) to it; by severity that is 11 critical, 25 high, 5 medium.

Threats that use T1685.005 most often also use T1059.001 PowerShell (26 threats), T1490 Inhibit System Recovery (26 threats), T1489 Service Stop (22 threats), T1078 Valid Accounts (21 threats), T1486 Data Encrypted for Impact (20 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

21 tracked threat actors appear in the threats that use T1685.005; the most frequent are The Gentlemen (3), VECT (3), ALPHV (2), Anubis (2), BlackCat (2).

Threat actors using it

Tracked threats

The 30 most recent of 41 tracked threats that use T1685.005.

Parent technique

T1685 Disable or Modify Tools — 750 tracked threats at the technique level.