1102 Security log · Log Management critical severity low volume

Windows Event ID 1102 — The audit log was cleared

The Windows Security Event Log was cleared programmatically (wevtutil, Event Viewer, or scripts).

Why event 1102 matters

Classic defense evasion. Attackers clear logs to destroy forensic evidence after establishing persistence or before ransomware deployment. Tools: wevtutil cl Security, PowerShell Clear-EventLog, Metasploit clearev module.

How to detect it

Alert on every occurrence. Check SubjectUserName — user/service accounts clearing logs are suspicious. Correlate ±5 min with 4688 for wevtutil or PowerShell parent processes. Also watch 6005/6006 (event log service restart).

Log source
Security
Advanced Audit Policy — enable the 'Log Management' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameSubjectDomainName

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Indicator Removal: Clear Windows Event Logs (T1070.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Windows Security Event Log Cleared
status: stable
description: Detects clearing of the Windows Security event log
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 1102
    condition: selection
falsepositives:
    - Documented administrative log rotation
level: high
tags:
    - attack.defense_evasion
    - attack.t1070.001
Sentinel / Defender KQL
SecurityEvent
| where EventID == 1102   // The audit log was cleared
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=1102
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The audit log was cleared — add EventData fields: SubjectUserName, SubjectDomainName`
Hunt event 1102 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

References

Related Log Management events

104 The System event log was cleared

Frequently asked questions

What is Windows Event ID 1102?

The audit log was cleared. The Windows Security Event Log was cleared programmatically (wevtutil, Event Viewer, or scripts).

Which log records event 1102?

Event 1102 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Log Management' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 1102?

Event 1102 is associated with: Indicator Removal: Clear Windows Event Logs (T1070.001).

How do you detect activity around event 1102?

Alert on every occurrence. Check SubjectUserName — user/service accounts clearing logs are suspicious. Correlate ±5 min with 4688 for wevtutil or PowerShell parent processes. Also watch 6005/6006 (event log service restart).