Operation Poisson: Log Clearing and Bulk File Deletion for Forensic Evasion

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects various methods of anti-forensics activity commonly used to hide attacker presence, including clearing Windows Event Logs via wevtutil or PowerShell, deleting the USN Journal via fsutil, and bulk file deletion using command-line utilities.