XHOPELESS Wiper Clearing Windows Event Logs via wevtutil/Clear-EventLog

Subhankar H@Andrewsec57

•updated Sep 7, 2026•2•0•3

Detects the clearing of Windows event logs using the native 'wevtutil.exe' command or the PowerShell 'Clear-EventLog' cmdlet. This activity is commonly associated with anti-forensic techniques used by threat actors and wiper malware to obstruct incident response efforts and remove traces of malicious activity.