Operation Poisson file deletion and Windows event log clearing (T1070)

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•7

Detects suspicious file deletion activities using 'del' command with '/f' flag or 'Remove-Item' PowerShell cmdlet, and log clearing activities using 'wevtutil cl' or 'Clear-EventLog' PowerShell cmdlet. It also identifies Windows Event Log clearing events (Event ID 1102). The rule also includes a specific check for known malicious artifacts in the command line.