Anti-Forensics

This brief details the detection of malicious Windows Event Log clearing using the native wevtutil utility, a common technique employed by ransomware groups to obstruct forensic investigations.

Adversaries utilize PowerShell commands to modify file system metadata, specifically targeting creation, access, and modification timestamps to evade detection and hinder forensic analysis.

Adversaries, including ransomware operators, use the Windows fsutil utility to delete USN journals or truncate files to inhibit forensic analysis and support data destruction.

Adversaries often attempt to clear PowerShell command history to conceal malicious activities conducted during a security incident.

Adversaries may delete the USN journal on Windows systems using `fsutil.exe` to remove evidence of file modifications and other activities, hindering forensic investigations and incident response.