Operation Poisson Log and Artifact Clearing via wevtutil and PowerShell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects attempts to clear Windows event logs using native utilities (wevtutil), remove shell history files (bash_history, PowerShell history), or perform secure file deletion using cipher.exe, which are techniques commonly used by attackers to remove forensic evidence of their activities.