The Gentlemen Ransomware: Event Log Clearing and Artifact Deletion

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects attempts to clear Windows Event Logs using wevtutil or PowerShell, and the suspicious deletion of files in sensitive directories (AppData, ProgramData, Temp, Users) using the command prompt. These behaviors are commonly associated with anti-forensics and data destruction activities used by adversaries to hide their tracks during an intrusion.