[Rule Tuning] Clearing Windows Event Logs

[Samirbous]

Description

Tuning of this rule by adding pe.original_file_name and also adding wevtutil arg /e:false that can be used to disable tracing (e.g. LockerGoga ransomware disables WMI ETW using this command). Example of KQL:

Example Data