Settra Ransomware: Misspelled wevtutil Defender Log Clear Attempt
Detects the use of wevtutil.exe to clear the Microsoft-Windows-Defender/Operational event log, which is often done by adversaries to remove evidence of security software activity or detection.
CQL
