Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method. Specifically, it looks for EventID 5858 in the WMI-Activity operational log when the Operation field contains both Win32_NTEventlogFile and cleareventlog, indicating a WMI operation encountered an error (e.g., access denied or provider failure). Note that successful clears will not generate this event; corroborate with Security event 1102 (audit log cleared) or System event 104 for confirmed clears. This rule serves as an indicator of potential log-clearing activity that could be used to cover tracks or hinder incident response. false positives may arise from legitimate administrative or maintenance tooling performing WMI operations that fail due to transient issues; correlate with additional signals to distinguish benign from malicious activity.