Payouts King / BlackBasta: Windows Event Log Clearing via wevtutil, EvtClearLog, or Clear-EventLog

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or PowerShell cmdlets. Attackers often clear logs to remove evidence of their malicious activities after achieving persistence or executing other operations.