The Gentlemen Ransomware: wevtutil Multi-Channel Event Log Clearing

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects usage of the Windows Event Utility (wevtutil.exe) with the 'cl' command-line flag, which is commonly used to clear specific Windows Event logs such as Security, System, Application, or Setup. This behavior is frequently associated with attackers attempting to remove forensic artifacts and log entries after unauthorized activity.