Forensics-Avoidance

Adversaries, particularly ransomware operators, use the Windows built-in tool wevtutil.exe to disable security event logs, effectively blinding detection systems and hindering forensic investigation.