BYOVD - System Log Wiping Sequence (T1070.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•4

Correlates the EDR kill sequence with the attacker utilizing wevtutil to clear the Security and System event logs to cover their tracks. This rule detects the execution of 'wevtutil.exe' with the 'cl' (clear log) command targeting 'System' or 'Security' event logs, joined with the creation of a '.sys' file, which could indicate a Bring Your Own Vulnerable Driver (BYOVD) attack attempting to disable EDR and clear logs.