Suspicious Use of PsLogList for Event Log Access or Clearing

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•2•0•48

Detects the use of the PsLogList utility to dump Windows event logs (security, application, system) or to clear them. This activity can be indicative of account discovery attempts or anti-forensics techniques by adversaries.