Suspicious PowerShell Event Log Clearing

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•4•0•20

Detects usage of known PowerShell cmdlets such as "Clear-EventLog", "Remove-EventLog", "Limit-EventLog", "Clear-WinEvent", or direct .NET calls to clear Windows event logs. This activity is often performed by adversaries to remove forensic evidence of their actions on a compromised system.