Robuta

https://attack.mitre.org/techniques/T1685/001/ Disable or Modify Tools: Disable or Modify Windows Event Log, Sub-technique T1685.001 - Enterprise... windows event log