Rule name: "Skopnix: Windows event log cleared with wevtutil (T1685.005)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process Name" ILIKE 'wevtutil.exe' AND ("Process CommandLine" ILIKE '% cl %' OR "Process CommandLine" ILIKE '% clear-log %')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1685.005".
FP-safety: Only the clear verbs match; wevtutil queries, exports and log configuration do not.