diff --git a/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs-remotely.yml b/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs-remotely.yml
new file mode 100644
index 00000000..efafc319
--- /dev/null
+++ b/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs-remotely.yml
@@ -0,0 +1,20 @@
+rule:
+  meta:
+    name: clear Windows event logs remotely
+    namespace: anti-analysis/anti-forensic/clear-logs
+    authors:
+      - 99.elad.levi@gmail.com
+    scopes:
+      static: function
+      dynamic: span of calls
+    att&ck:
+      - Defense Evasion::Indicator Removal::Clear Windows Event Logs [T1070.001]
+    references:
+      - https://github.com/getel-arch/ClearLogsRemotely
+    examples:
+      - 4f509bdfe5a2fe4320cdc070eedc0a72e12cc08f43d60a7701305b3d1408102b:0x1400014de
+  features:
+    - and:
+      - api: wevtapi.EvtOpenSession
+      - api: wevtapi.EvtOpenLog
+      - api: wevtapi.EvtClearLog
diff --git a/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml b/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
index d490ea14..d35238a5 100644
--- a/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
+++ b/anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
@@ -20,9 +20,12 @@ rule:
           - or:
             - api: advapi32.ElfClearEventLogFile
             - api: advapi32.ClearEventLog
+            - api: wevtapi.EvtClearLog
           - optional:
             - api: advapi32.OpenEventLog
             - api: advapi32.GetNumberOfEventLogRecords
+            - api: wevtapi.EvtOpenLog
+            - api: wevtapi.EvtOpenSession
         - basic block:
           - and:
             - string: /wevtutil(\.exe)?\s+(clear-log|cl)/i