Remote Event Log Clearing via SMB

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects attempts to remotely clear event logs over Server Message Block (SMB) by looking for the strings "Eventlog" and "ClearEventLog" in TCP traffic destined for port 445. This activity is often associated with adversaries attempting to remove forensic evidence of their presence on a system.