Windows Event Log Clearing via wevtutil.exe or PowerShell Clear-EventLog

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or the PowerShell 'Clear-EventLog' command. This behavior is often associated with adversaries attempting to remove evidence of their actions from a compromised system.