Clearing of forensic evidence from event logs using wevtutil
This query checks for attempts to clear at least 10 log entries from event logs using wevtutil.
Microsoft Sentinel (KQL)

This query checks for attempts to clear at least 10 log entries from event logs using wevtutil.

Already have an account?