Windows event log clearing via wevtutil or Clear-EventLog

Ibrahim Saud@tektrix

•updated Jul 2, 2026•4•1•9

Detects the clearing of Windows Security or System event logs using either the 'wevtutil' command-line utility or the 'Clear-EventLog' PowerShell cmdlet. This activity is commonly associated with anti-forensic efforts by adversaries to remove evidence of malicious actions, such as credential harvesting, following a compromise.