Showboat - Taunting via Wevtutil Log Wiping (T1070.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Detects the specific defense evasion tactic where malware invokes wevtutil to clear event logs immediately after executing its payload, effectively taunting defenders. This rule specifically looks for 'wevtutil.exe' being executed with the 'cl' (clear log) command-line argument, and filters out common legitimate processes like cmd.exe, powershell.exe, and explorer.exe as initiating processes.