Kazuar - Selective Event Log Tampering via API (T1070.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Detects Kazuar clearing specific Security logs via the ClearEventLog Windows API immediately after lateral movement. The rule specifically looks for 'ClearEventLogApiCall' actions and excludes common legitimate tools like 'wevtutil.exe' and 'powershell.exe' that might perform similar actions.