wevtutil Clear Critical Event Logs

nomit vyas@xoxo

•updated Apr 30, 2026•12•0•953

Detects the usage of 'wevtutil.exe' to clear critical Windows event logs (Application, Security, System, Windows PowerShell). This activity is often associated with defense evasion tactics used by adversaries, including ransomware like VECT, to remove forensic evidence.