Settra ransomware mass clearing of Windows Event Logs via wevtutil
Detects potential anti-forensic activity involving the clearing of multiple Windows Event Logs within a short time frame using the 'wevtutil' utility. This behavior is often indicative of an adversary attempting to remove traces of post-compromise activity.
Splunk (SPL)
