Windows audit log cleared

windows

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1070-indicator-removal

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when a user clears Windows Security logs.

Strategy

Monitoring of Windows event logs where @evt.id is 1102.

Triage and response

Verify if {{@Event.UserData.LogFileCleared.SubjectUserName}} has a legitimate reason to clear the security event logs on {{host}}.

Changelog

27 October 2022 - Updated tags.