🎯 Windows Event Log clearing

The items that name it 3

• Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
  writeup2026-09-17

  Threat actor cleared several Windows Event Logs (Application, Security, System, Setup, ForwardedEvents, TerminalServices-LocalSessionManager/Operational, TerminalServices-RDPClient/Operational, Sysmon/Operational, PowerShell/Operational, WinRM/Operational, TaskScheduler/Operational, Defender/Operati

• DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
  writeup2026-06-08It is written here as Windows Event Log clearing (Clr mode).

  Uses EvtOpenLog/EvtClearLog APIs and WMI activity log wipe for anti-forensics; present in every version.

• The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress
  writeup2026-05-21

  Security, System, and Application Event Logs cleared (Event ID 104 for Application/System, Event ID 1102 for Security) to evade detection