Payouts King - Windows Event Log Cleared via wevtutil or PowerShell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•5

Detects attempts to clear Windows Event Logs via common administrative tools such as 'wevtutil.exe', PowerShell, or the detection of specific system events indicating logs have been cleared (Event IDs 1102 and 104).