Operation Poisson Event Log and Artifact Cleanup via wevtutil, Clear-EventLog, or PSReadLine History Deletion

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects evidence of log and artifact tampering on a Windows host, specifically the clearing of Windows System or Security logs using wevtutil or PowerShell, the stopping of the EventLog service, or the deletion of PowerShell PSReadLine history files. Such activity is often conducted by an adversary to conceal malicious actions.