Mass Windows Event Log Clearing via wevtutil, Clear-EventLog, or Web Server Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

Detects attempts to clear Windows event logs using the native 'wevtutil' command-line utility or PowerShell 'Clear-EventLog' command. The rule applies elevated risk levels when the activity is initiated by system-level processes or accounts, which is often indicative of adversary activity attempting to remove forensic evidence of post-exploitation actions.