The Gentlemen RaaS Windows Event Log Clearing via wevtutil or PowerShell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects malicious attempts to clear Windows Event Logs using native utilities like wevtutil or PowerShell, or by direct file deletion of .evtx files. This behavior is common in post-exploitation cleanup phases by threat actors, such as The Gentlemen RaaS, to hinder incident response and forensic analysis.