The Windows Security Event Log was cleared programmatically (wevtutil, Event Viewer, or scripts).
Classic defense evasion. Attackers clear logs to destroy forensic evidence after establishing persistence or before ransomware deployment. Tools: wevtutil cl Security, PowerShell Clear-EventLog, Metasploit clearev module.
Alert on every occurrence. Check SubjectUserName — user/service accounts clearing logs are suspicious. Correlate ±5 min with 4688 for wevtutil or PowerShell parent processes. Also watch 6005/6006 (event log service restart).
SubjectUserNameSubjectDomainName | Tactic | Technique |
|---|---|
| Defense Evasion | Indicator Removal: Clear Windows Event Logs (T1070.001) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Windows Security Event Log Cleared
status: stable
description: Detects clearing of the Windows Security event log
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 1102
condition: selection
falsepositives:
- Documented administrative log rotation
level: high
tags:
- attack.defense_evasion
- attack.t1070.001
SecurityEvent
| where EventID == 1102 // The audit log was cleared
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=1102
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The audit log was cleared — add EventData fields: SubjectUserName, SubjectDomainName`
The audit log was cleared. The Windows Security Event Log was cleared programmatically (wevtutil, Event Viewer, or scripts).
Event 1102 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Log Management' subcategory (Success and/or Failure).
Event 1102 is associated with: Indicator Removal: Clear Windows Event Logs (T1070.001).
Alert on every occurrence. Check SubjectUserName — user/service accounts clearing logs are suspicious. Correlate ±5 min with 4688 for wevtutil or PowerShell parent processes. Also watch 6005/6006 (event log service restart).