CAR-2021-01-003: Clearing Windows Logs with Wevtutil
Detects when logs are cleared using the legitimate tool "wevtutil". This is usually done by threat actors to clear traces using LOLBins.
Microsoft Sentinel (KQL)
Detects when logs are cleared using the legitimate tool "wevtutil". This is usually done by threat actors to clear traces using LOLBins.
Already have an account?