Gentlemen Clears Windows Event Logs

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•7

Detects command-line clearing of security, system, application, or PowerShell event logs to impede investigation. This rule specifically looks for the use of 'wevtutil.exe', 'powershell.exe', or 'cmd.exe' with command-line arguments indicative of clearing event logs, such as 'wevtutil.*(cl|clear-log)', 'Clear-EventLog', or 'Remove-EventLog'.