The Gentlemen RaaS: Log and USN Journal Wiping with Prior Service Install Correlation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects activities related to clearing or deleting Windows Event Logs, including usage of 'wevtutil.exe' to clear specific logs, 'cmd.exe' or PowerShell ('Remove-Item') to manually delete '.evtx' files, and the erasure of the USN journal via 'fsutil.exe'. It also detects the actual occurrence of Event IDs 1102 (Security log cleared) and 104 (System log cleared). The rule correlates these events with preceding service installations within the last 24 hours to distinguish between potential attacker anti-forensics activity and routine administrative maintenance.