Event Log Clearing via wevtutil or PowerShell Clear-EventLog

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or PowerShell cmdlets 'Clear-EventLog' and 'Remove-EventLog'. Adversaries often perform this action to remove evidence of their presence or malicious activities from a compromised system.