CmdID / PowerShell / Cmdlets / Clear
Clear-EventLog
Clears all entries from specified event logs on the local or remote computers. PowerShell reference
From the PowerShell reference 4 parameters 1 Sigma rule looks for it
What it does
Clears all entries from specified event logs on the local or remote computers. The Clear-EventLog cmdlet deletes all of the entries from the specified event logs on the local computer or on remote computers. To use Clear-EventLog, you must be a member of the Administrators group on the affected computer. The cmdlets that contain the EventLog noun (the EventLog cmdlets) work only on classic event logs. To get events from logs that use the Windows Event Log technology in Windows Vista and later versions of Windows, use the Get-WinEvent cmdlet.
Clear-EventLog [-LogName] <String[]> [[-ComputerName] <String[]>] [-WhatIf] [-Confirm] [<CommonParameters>]Clear specific event log types from the local computer
Clear-EventLog "Windows PowerShell"IdentifyTrips 1 Sigma rule: highSuspicious Eventlog Clearing or Configuration Change Activity by Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
Clear specific multiple log types from the local and remote computers
Clear-EventLog -LogName ODiag, OSession -ComputerName localhost, Server02IdentifyTrips 1 Sigma rule: highSuspicious Eventlog Clearing or Configuration Change Activity by Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
Clear all logs on the specified computers then display the event log list
Clear-EventLog -LogName Application, System -ConfirmIdentifyTrips 1 Sigma rule: highSuspicious Eventlog Clearing or Configuration Change Activity by Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
Clear all logs on the specified computers then display the event log list
function clear-all-event-logs ($ComputerName="localhost")
{
$logs = Get-EventLog -ComputerName $ComputerName -List | ForEach-Object {$_.Log}
$logs | ForEach-Object {Clear-EventLog -ComputerName $ComputerName -LogName $_ }
Get-EventLog -ComputerName $ComputerName -List
}
clear-all-event-logs -ComputerName Server01IdentifyTrips 2 Sigma rules: highSuspicious Eventlog Clearing or Configuration Change Activity by Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems); mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Its page in the reference: Clear-EventLog.
Parameters
-ComputerNameSpecifies a remote computer. The default is the local computer.
This parameter does not rely on Windows PowerShell remoting. You can use the ComputerName parameter of Get-EventLog even if your computer is not configured to run remote commands.-LogNameSpecifies the event logs. Enter the log name (the value of the Log property not the LogDisplayName) of one or more event logs, separated by commas. Wildcard characters are not permitted. This parameter is required.
IMPORTANT: This parameter is supposed to accept values from the pipeline by property name. However, there is a bug that prevents this from working. You must pass a value using the parameter directly.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.