Windows Event Log Clearing via wevtutil or Clear-EventLog (T1070.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•4

This rule detects attempts to clear Windows Event Logs using either 'wevtutil.exe', PowerShell 'Clear-EventLog' command, or by monitoring specific Windows Event IDs (1102 and 104) which indicate logs have been cleared. Clearing event logs is a common technique used by attackers to hide malicious activity and evade detection.