Ransomware Series: Nova/Gentlemen Ransomware Mass Event Log Clearing via wevtuti

Ibrahim Saud@tektrix

•updated Sep 25, 2026•3•0•8

Detects unauthorized mass clearing of Windows Event Logs using wevtutil or PowerShell cmdlets. This behavior is often observed in ransomware campaigns (e.g., Nova, Gentlemen) as an anti-forensic measure to hinder incident response and investigation by removing audit trails across significant log channels like Security, System, and PowerShell.