Suspicious Event Log Clearing or Configuration Change Activity

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•1•0•36

Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique is used by threat actors and ransomware strains to evade defenses by removing forensic evidence.