Payouts King Windows Event Log Clearing via wevtutil or Clear-EventLog

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•5

Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility with the 'cl' command, the PowerShell 'Clear-EventLog' cmdlet, or by identifying specific system events (EventID 1102 and 104) that signify the security or system logs have been cleared.