Nightspire - Clearing Windows Event Logs (T1070.001)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•6

Detects the post-encryption cleanup routine where Nightspire utilizes wevtutil to clear Security, System, and Application event logs to hinder incident response efforts. This rule specifically looks for the execution of 'wevtutil.exe' with the 'cl' (clear log) command targeting 'System', 'Security', or 'Application' event logs, and correlates it with the presence of files ending with '.nightspire' on the same device.