Procedure examples

SynAck clears event logs.

RansomHub can delete events from the Security, System, and Application logs.

Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.

DUSTTRAP can delete infected system log information.

Mafalda can delete Windows Event logs by invoking the `OpenEventLogW` and `ClearEventLogW` functions.

ShrinkLocker calls Wevtutil to clear the Windows PowerShell and Microsoft-Windows-Powershell/Operational logs.

Apostle will attempt to delete all event logs on a victim machine following file wipe activity.

BlackCat can clear Windows event logs using `wevtutil.exe`.

Lucifer can clear and remove event logs.

The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.

NotPetya uses wevtutil to clear the Windows event logs.

RunningRAT contains code to clear event logs.

MultiLayer Wiper removes Windows event logs during execution.

LockBit 3.0 can delete log files on targeted systems.

Hydraq creates a backdoor through which remote attackers can clear all system event logs.

gh0st RAT is able to wipe event logs.

HermeticWiper can overwrite the `C:\Windows\System32\winevt\Logs` file on a targeted system.

LockBit 2.0 can delete log files through the use of wevtutil.

FinFisher clears the system event logs using OpenEventLog/ClearEventLog APIs .

ZxShell has a command to clear system event logs.

Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.

KillDisk deletes Application, Security, Setup, and System Windows Event Logs.

Qilin has the ability to clear Windows Event Logs.

HermeticWizard has the ability to use `wevtutil cl system` to clear event logs.

Pupy has a module to clear event logs with PowerShell.

Wevtutil can be used to clear system and security event logs from the system.