Wevtutil
- ID
- S0645
- Type
- Tool
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Wevtutil is a Windows command-line utility that enables administrators to retrieve information about event logs and publishers.[1]
Techniques used (3)
- T1005 Data from Local System
- T1685.001 Disable or Modify Windows Event Log
- T1685.005 Clear Windows Event Logs
Groups using it (7)
- G0007 APT28
- G0129 Mustang Panda
- G0143 Aquatic Panda
- G1017 Volt Typhoon
- G1040 Play
- G1054 MirrorFace
- G1058 The Gentlemen