Once a system has been exploited, the attacker must cover their tracks to avoid detection, or at least make reconstruction of the event more difficult for the defender.
An attacker may completely delete the Windows event logs (if they are being actively retained on the compromised server). This can be done via a command shell to the system, using the following command:
C:\> del %WINDIR%\*.log /a/s/q/f
The command directs for all of the logs to be deleted (/a), including all files from subfolders (/s). The /q option disables all of the queries, asking for a yes or no response, and the /f option forcibly removes the files, making recovery more difficult.
To wipe out specific recorded files, attackers must keep track of all the activities that have been performed on the compromised system.
This can also be done from the Meterpreter prompt by using...
