Nova ransomware clears Windows Event Logs via PowerShell and wevtutil

Brandon Rodriguez@BMRodriguez

•updated Aug 14, 2026•4•0•6

Detects efforts to clear Windows Event Logs using PowerShell (Clear-EventLog, EventLogSession.ClearLog) or wevtutil.exe (cl, clear-log). This behavior is characteristic of anti-forensic activities performed by ransomware like Nova to impede incident response and investigation efforts.