104 System log · Log Management high severity low volume

System Event ID 104 — The System event log was cleared

The System event log was cleared. Equivalent of Security 1102 but for the System log.

Why event 104 matters

Same defense evasion context as 1102. Attackers clear System log to remove service installation (7045) and other persistence evidence.

How to detect it

Alert on every occurrence. Correlate with Security 1102 — attackers often clear multiple logs simultaneously.

Log source
System
Logged by default in the System channel; no audit policy required.
Fields to pivot on
SubjectUserNameChannel

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Indicator Removal: Clear Windows Event Logs (T1070.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: System Event Log Cleared
status: stable
description: System event log cleared
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 104
    condition: selection
falsepositives:
    - Documented administrative log rotation
level: high
tags:
    - attack.defense_evasion
    - attack.t1070.001
Sentinel / Defender KQL
Event
| where EventLog == "System" and EventID == 104   // The System event log was cleared
// EventData holds: SubjectUserName, Channel
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:System" EventCode=104
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The System event log was cleared — add EventData fields: SubjectUserName, Channel`
Hunt event 104 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Log Management events

1102 The audit log was cleared

Frequently asked questions

What is System Event ID 104?

The System event log was cleared. The System event log was cleared. Equivalent of Security 1102 but for the System log.

Which log records event 104?

Event 104 is written to the System channel by Service Control Manager / Kernel. Logged by default in the System channel; no audit policy required.

What MITRE ATT&CK techniques map to event 104?

Event 104 is associated with: Indicator Removal: Clear Windows Event Logs (T1070.001).

How do you detect activity around event 104?

Alert on every occurrence. Correlate with Security 1102 — attackers often clear multiple logs simultaneously.