Windows Event Log EVTX File Deleted
This rule detects the deletion of Windows Event Log (EVTX) files. Adversaries often delete these logs to remove forensic evidence of their activities, making it harder for defenders to investigate and understand the scope of a compromise. The rule specifically looks for file deletion events where the target filename starts with 'C:\Windows\System32\winevt\Logs\' and ends with '.evtx', which are the standard locations and extensions for Windows Event Log files.
Sigma
