The Gentlemen RaaS mw_clearEVTLog - Multi-Log Clearing via wevtutil
Detects the clearing of multiple Windows Event Logs using the built-in 'wevtutil.exe' utility. This behavior is often associated with adversaries attempting to remove evidence of their presence or activities by clearing system, security, or application event logs.
Splunk (SPL)
