GigaWiper Event Log Clearing via wevtutil cl or Security.evtx Deletion

Duo Tech@duotech

•updated Jul 21, 2026•1•0•3

Detects evidence of log clearing or tampering activity associated with the GigaWiper destructive backdoor, specifically monitoring for the use of wevtutil to clear event logs, the manual deletion of the Security.evtx log file, or the presence of a specific marker string often utilized by this threat.