Payouts King - Windows Event Log Clearing via wevtutil or EvtClearLog

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects attempts to clear Windows event logs using the wevtutil.exe command-line utility or by triggering native Windows Event Log IDs 1102 (Security log cleared) or 104 (System log cleared). Clearing these logs is a common technique used by adversaries to hide indicators of malicious activity following an intrusion.