I'm analyzing several hacked machines on our network. On the original hacked machine, I've found event logs indicating a series of successful RDP connections to other machines, but when I go to those machines and check the RDP connection logs, I don't see any logs at all around that time period. I also don't see much in the security or application log except for DWM sessions starting.

I know that functionality to delete specific events from the log is not exposed, but do you know of any tools that can modify event log exports? I'm thinking maybe the log was backed up and cleared and then the backup was tampered with before restoring or something like that. Otherwise, I'm not sure how I could have logs on one machine but only have logs before and after on the others.


  • Are they all Windows machines?
    – ahron
    Apr 26, 2019 at 7:58
  • Yes, these are all windows machines.
    – S.C.
    Apr 26, 2019 at 13:55

2 Answers 2


On Unix systems, the logs are just text files. Generally only specific processes/daemons have the ability to edit them, but a user with sudo access can do it too. Just process it like any other text file.

On Windows, it is again a similar story - in a nutshell, someone with admin rights can tamper the system. Although for Windows they will need specific tools like WinZapper. See this security.se question for a good discussion on this topic.

  • WinZapper looks interesting. I'll have to mess around with that and see if I can recreate what I see here. Thanks.
    – S.C.
    Apr 26, 2019 at 13:58
  • .evtx are not just text files. Apr 26, 2019 at 23:32
  • @user2320464 Indeed, they're not. Which is why one will need special tools to tinker/tamper with them.
    – ahron
    Apr 27, 2019 at 6:00

As far as I know, there is no way to delete/alter individual events from an event log (Application, System, Security, etc.) under Windows. The "most" you can do is delete them, but even that would generate an event in the case where the Security log is cleared (Event ID 1102).


Apparently, Shadow Brokers released a tool called EventLogEdit that allows to edit events on the fly, even when the system is running.


Though I have yet to read about it being used in any attacks so far.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .