Windows Event Log Clearing via wevtutil or Clear-EventLog (i.bat)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects attempts to clear Windows Event Logs using common utilities like 'wevtutil' or 'Clear-EventLog', or execution triggered by batch scripts (e.g., i.bat), which is often associated with adversaries attempting to remove evidence of their activities.