StrikeShark Event Log Clearing and Security Tool Tampering Defense Evasion

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects attempts to clear Windows event logs using the built-in 'wevtutil.exe' utility or PowerShell cmdlets 'Clear-EventLog'. Adversaries often perform this action to remove evidence of malicious activity from the host.