T1070.001 Windows Event Log Clearing via wevtutil or PowerShell

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects attempts to clear Windows event logs using the wevtutil command-line utility or PowerShell cmdlets (Clear-EventLog, Remove-EventLog). Adversaries often clear event logs to hinder forensic investigations and remove evidence of their malicious activity.