Settra Ransomware: Bulk Windows Event Log Clearing via wevtutil
Detects the suspicious sequential execution of the 'wevtutil cl' command to clear multiple critical Windows Event Log channels, including security, system, and application logs. This behavior is indicative of anti-forensic activities performed by adversaries, such as the Settra ransomware, to hinder incident response and forensic analysis.
YARA-L
