What are the three main methods to overwrite the original system log file after modifying it?

The three methods are: (1) Releasing file locks by terminating the EventLog process, replacing the file, and restarting the service; (2) Injecting a DLL into the log process to gain a file handle and modify memory directly; (3) Using `DuplicateHandle` to duplicate a file handle from another process and then overwrite the log file content in memory. Each method has trade-offs—injection may be intercepted, and releasing locks creates EventID 7034/7036 logs. For implementation details, refer to the related series: [Windows XML Event Log (EVTX) Single Log Entry Deletion (Part 3)](/news/penetration-techniques-deleting-single-windows-log-entries) and subsequent parts.