Event Log Clearing via wevtutil or Clear-EventLog Cmdlet

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•0

Detects attempts to clear Windows Event Logs using either the built-in 'wevtutil.exe' utility or the PowerShell 'Clear-EventLog' cmdlet. Attackers often clear these logs to remove evidence of intrusion activities, such as persistence mechanisms, account creation, or privilege escalation.