Windows Event Log Clearing via wevtutil or Clear-EventLog

Ibrahim Saud@tektrix

•updated Jul 2, 2026•4•0•7

This rule detects attempts to clear Windows event logs using either the 'wevtutil.exe' command-line utility or the 'Clear-EventLog' PowerShell cmdlet. Adversaries often clear event logs to hide evidence of their activity on a compromised host.