Windows Event Log Clearing via wevtutil or PowerShell (T1070.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•4

Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or the 'Clear-EventLog' PowerShell cmdlet. Clearing event logs is a common technique used by adversaries to hide traces of their activities on a compromised host.