CmdID / PowerShell / Cmdlets / Remove
Remove-EventLog
Deletes an event log or unregisters an event source. PowerShell reference
From the PowerShell reference 5 parameters 1 Sigma rule looks for it
What it does
Deletes an event log or unregisters an event source. The Remove-EventLogcmdlet deletes an event log file from a local or remote computer and unregisters all its event sources for the log. You can also use this cmdlet to unregister event sources without deleting any event logs. The cmdlets that contain the EventLog noun, the EventLog cmdlets, work only on classic event logs. To get events from logs that use the Windows Event Log technology in Windows Vista and later versions of the Windows operating system, use Get-WinEvent. WARNING: This cmdlet can delete operating system event logs, which might cause application failures and unexpected system behavior.
Remove-EventLog [[-ComputerName] <String[]>] [-LogName] <String[]> [-WhatIf] [-Confirm] [<CommonParameters>]Remove-EventLog [[-ComputerName] <String[]>] [-Source <String[]>] [-WhatIf] [-Confirm] [<CommonParameters>]Remove an event log from the local computer
Remove-EventLog -LogName "MyLog"IdentifyTrips 1 Sigma rule: highSuspicious Eventlog Clearing or Configuration Change Activity by Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
Remove an event log from several computers
Remove-EventLog -LogName "MyLog", "TestLog" -ComputerName "Server01", "Server02", "localhost"IdentifyTrips 1 Sigma rule: highSuspicious Eventlog Clearing or Configuration Change Activity by Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
Delete an event source
Remove-EventLog -Source "MyApp"IdentifyTrips 1 Sigma rule: highSuspicious Eventlog Clearing or Configuration Change Activity by Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
Remove an event log and confirm the action
Get-EventLog -ListIdentifyTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Remove an event source and confirm the action
Get-WmiObject Win32_NTEventlogFile -Filter "logfilename='TestLog'" | foreach {$_.Sources}IdentifyIts page in the reference: Remove-EventLog.
Parameters
-ComputerNameSpecifies a remote computer. The default is the local computer.
This parameter does not rely on Windows PowerShell remoting. You can use the ComputerName parameter of Remove-EventLogeven if your computer is not configured to run remote commands.-LogNameSpecifies the event logs. Enter the log name of one or more event logs, separated by commas. The log name is the value of the Log property, not the LogDisplayName, Wildcard characters are not permitted. This parameter is required.-SourceSpecifies the event sources that this cmdlet unregisters. Enter the source names, not the executable name, separated by commas.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.