Wevtutil — Malware Profile

Wevtutil is a Windows command-line utility that enables administrators to retrieve information about event logs and publishers.

MITRE ATT&CK techniques (3)

• T1005 Data from Local System
• T1685.001 Disable or Modify Windows Event Log
• T1685.005 Clear Windows Event Logs

Attributed threat actors

• Play Ransomware
• MirrorFace
• Mustang Panda
• Aquatic Panda
• APT28
• Volt Typhoon

Read the full analysis on IntelFusions