Settra Ransomware: Mass Windows Event Log Clearing via wevtutil

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•3

Detects the use of the 'wevtutil.exe' utility to clear Windows Event Logs. This is a common technique used by adversaries to disrupt logging and evade detection of their actions on a host. The rule specifically monitors for the 'cl' (clear-log) command applied to sensitive operational channels, triggering when multiple clearing operations are detected within a 5-minute window.