StrikeShark ETW and Windows Event Log Tampering via wevtutil or auditpol

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•7

This rule detects activities associated with post-exploitation cleanup and defense evasion on Windows systems. It identifies the clearing of Security and System event logs using 'wevtutil.exe' or PowerShell, as well as the modification of audit policies using 'auditpol.exe' to potentially disable logging or auditing capabilities.