Windows Event Log Clearing via wevtutil or Clear-EventLog

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects attempts to clear Windows Event Logs using common utilities including wevtutil, PowerShell (Clear-EventLog, EvtClearLog), or command-line wrappers. Clearing event logs is a common technique used by adversaries to disrupt incident response and cover their tracks after an intrusion.