Payouts King - Windows Event Log Clearing via wevtutil or Event ID 1102/104
Detects attempts to clear Windows event logs using built-in utilities including wevtutil.exe, PowerShell, or through direct event log event ID triggers (1102, 104). This activity is often associated with adversaries attempting to remove evidence of their presence on a system.
Cortex XDR
