Covering Tracks: Windows Event Log Deletion
After compromising a Windows system, an attacker wants to cover tracks by deleting event logs. Which command would achieve this?
Quick Answer
The answer is wevtutil cl Security. This command is the correct choice because it directly clears the Windows Security event log using a built-in utility, requiring no external tools and only administrative privileges to execute. In the context of covering tracks, an attacker would use this to remove forensic evidence of their activities, such as failed login attempts or privilege escalations, from the most monitored log. On the Certified Ethical Hacker CEH exam, this tests your knowledge of post-exploitation log management and the difference between native Windows commands versus third-party tools; a common trap is confusing wevtutil with the older eventtriggers or assuming a simple del command works on active logs. Remember the memory tip: “wevtutil cl” stands for “Windows Event Viewer Utility clear log,” and the Security log is the primary target for covering tracks because it records authentication events.
⚠ Common exam trap
It's easy for candidates to confuse the Windows command wevtutil with the Linux command rm -rf or the PowerShell cmdlet Clear-EventLog, assuming any log-clearing command works across platforms, but the CEH exam tests knowledge of OS-specific utilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
wevtutil cl Security
The wevtutil cl Security command clears the Windows Security event log, which is a standard method for an attacker to cover tracks by removing evidence of their activities. This command is built into Windows and can be executed from the command line with administrative privileges, making it a direct and effective way to delete event logs without relying on external tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
wevtutil cl Security
Why this is correct
`wevtutil cl Security` clears the Security event log directly, satisfying the attacker's goal of erasing logged activity on the compromised Windows host. The `cl` subcommand targets a named channel, so specifying `Security` wipes authentication and audit records that would otherwise reveal the intrusion during forensic review.
- ✗
del *.log
Why it's wrong here
Windows event logs are .evtx files held in a locked, protected directory, so a wildcard del of *.log matches nothing relevant and cannot remove them. It is tempting because deleting log files is a classic anti-forensics step, but that approach applies to plaintext application logs on disk, not the Windows event log store.
- ✗
rm -rf /var/log/*
Why it's wrong here
This is a Linux command targeting /var/log, which does not exist on Windows and would not touch the .evtx event log store. It is tempting because rm -rf /var/log/* is the standard Linux equivalent for wiping logs, and it would be correct when covering tracks on a compromised Linux host.
- ✗
clear-eventlog -Log Security
Why it's wrong here
clear-eventlog is a PowerShell cmdlet, not a Windows command, and its parameter is -LogName, so this syntax fails outright. It is tempting because clearing the Security log is exactly the anti-forensics goal, and the cmdlet would be the right tool when run correctly in a PowerShell session with sufficient privileges.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. After compromising a system, an attacker wants to erase their tracks. They clear the Windows Event Logs using `wevtutil cl` commands. However, the logs are forwarded to a remote SIEM. Which covering tracks technique would be MOST effective to avoid detection?
medium- ✓ A.Modify specific event log entries to remove evidence of their actions
- B.Disable Windows Event Log service (EventLog)
- C.Use a rootkit to hide files and processes
- D.Encrypt the log files
Why A: Modifying specific event log entries directly removes the incriminating evidence without disrupting the logging pipeline. Since logs are forwarded to a remote SIEM, simply clearing or disabling local logs would trigger an alert due to a gap in log forwarding. By surgically editing only the relevant entries (e.g., using PowerShell or API calls to alter Event Log records), the attacker avoids detection while the SIEM continues to receive logs, maintaining the appearance of normal operation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.