Event-Logs

Detection of Windows event log clearing using Event IDs 1102 (Security) or 104 (System) which may indicate an attempt to hide malicious activity and impede forensic investigation.

Adversaries clear Windows event logs to evade detection and destroy forensic evidence, breaking SIEM detections and covering their tracks.

Adversaries may clear Windows event logs using `wevtutil.exe` to remove evidence of their activity and hinder forensic investigations.

This threat brief covers the detection of adversaries clearing or disabling Windows event logs, a common defense evasion tactic, using tools like wevtutil.exe and PowerShell cmdlets to remove evidence of their activities.