Why this matters

Clearing Windows event logs removes the records an investigator needs, and in our assessment it is most often attempted late in an intrusion, as cleanup. The technique is catalogued in MITRE ATT&CK as Clear Windows Event Logs. It was historically T1070.001; Splunk’s research page for its analytic now maps it to T1685.005 under a Defense Impairment tactic, and the Sigma rule we reference carries the same newer tag, so our rules use T1685.005. Check which ID your ATT&CK version uses before tagging. Splunk’s page lists groups associated with the technique, including APT41, FIN8, HAFNIUM, Play and Volt Typhoon.

The clearing action itself is logged. Microsoft’s documentation for event 1102 says you should not normally see it and recommends monitoring it and investigating why the action was performed.

The telemetry that records a clear

  • Security 1102: “The audit log was cleared.” Raised when the Security log is cleared. Per Microsoft, the event carries SubjectUserSid, SubjectUserName, SubjectDomainName and SubjectLogonId, and the Logon ID can be correlated with a prior 4624 logon.
  • System 104: raised by the Microsoft-Windows-Eventlog provider when other logs are cleared. Sigma’s rule for this event covers the Security, System, Windows PowerShell, PowerShell/Operational, PowerShellCore/Operational and Sysmon/Operational channels. Sigma’s rule filters on a Channel field in these events to say which log was cleared; we did not see the event XML from Microsoft.
  • Process creation: wevtutil cl <log> (clear-log, with optional /bu: to back up events first, and /r: to target a remote host) and the PowerShell cmdlet Clear-EventLog, which per Microsoft requires administrator rights and works on classic logs only. Our assessment: the process view gives you the command line and parent process, while 1102 and 104 give you the account and are harder to evade than a command-line match. Run both.

Sigma: log cleared events

title: Windows Event Log Cleared (Security 1102 or System 104)
id: 8c0d3b5e-2f47-4a61-9d1b-7e5a4c2f9a10
status: experimental
description: Detects clearing of the Security log (1102) or of other logs (104)
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 1102
  condition: selection
falsepositives:
  - Planned log maintenance
  - Image preparation and provisioning
level: high
tags:
  - attack.defense-impairment
  - attack.t1685.005
---
title: Windows Event Log Cleared (System 104)
id: 1b7e6f20-93c4-4d8a-8a52-6c0e1d4b7f33
status: experimental
description: Detects the Eventlog provider reporting that a log was cleared (Security is covered by the 1102 rule above)
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: 'Microsoft-Windows-Eventlog'
    EventID: 104
    Channel:
      - System
      - Windows PowerShell
      - Microsoft-Windows-PowerShell/Operational
      - PowerShellCore/Operational
      - Microsoft-Windows-Sysmon/Operational
  condition: selection
falsepositives:
  - Log collection agent rollouts that reset the local log
  - Golden image preparation
level: high
tags:
  - attack.defense-impairment
  - attack.t1685.005

Sigma: command lines

title: Event Log Clearing via wevtutil or Clear-EventLog
id: 4e9a2d17-b6c3-47f0-8e15-0a3d7c9b5e62
status: experimental
description: Detects command lines used to clear Windows event logs
logsource:
  category: process_creation
  product: windows
detection:
  wevtutil:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains:
      - ' cl '
      - ' clear-log '
  powershell:
    CommandLine|contains:
      - 'Clear-EventLog'
  condition: wevtutil or powershell
falsepositives:
  - Administrators clearing logs during troubleshooting
level: high
tags:
  - attack.defense-impairment
  - attack.t1685.005

None of the Sigma, KQL or SPL here has been run against live data; they are our adaptations of the sources cited. The ' cl ' match misses wevtutil.exe cl at the end of a line and variants with different spacing; test against your own telemetry.

KQL (Microsoft Sentinel)

// Our adaptation, untested. Cleared logs from Windows events
let cleared = union
  (SecurityEvent
   | where EventID == 1102
   | project TimeGenerated, Computer, Source="Security 1102", Actor=SubjectUserName),
  (Event
   | where Source == "Microsoft-Windows-Eventlog" and EventID == 104
   | project TimeGenerated, Computer, Source="System 104", Actor=UserName);
cleared
| order by TimeGenerated desc;

// Command-line view (Defender for Endpoint)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName =~ "wevtutil.exe" and ProcessCommandLine matches regex @"\b(cl|clear-log)\b")
   or ProcessCommandLine has "Clear-EventLog"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

The Event table field names depend on your ingestion method. Confirm that UserName holds the actor in your workspace.

SPL (Splunk)

Adapted from the Splunk research analytic, which uses the same two events but its own CIM-based search (untested; index, source and field names depend on your add-on):

(index=wineventlog source="WinEventLog:Security" EventCode=1102)
OR (index=wineventlog source="WinEventLog:System" EventCode=104)
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, EventCode

Tuning and response

Expect benign hits from log agent rollouts and golden image builds (both noted in the Sigma rule). Suppress by host group and change window, not globally. Alert at high severity when the actor is not a known maintenance account, or when the clear follows a new logon or lateral movement from the same Logon ID.

A cleared log also means a gap: ask which logs were forwarded to your SIEM before the clear, since that copy is now your record. If forwarding was absent on the host, our assessment is that you should scope neighbouring hosts and the actor’s other logons, since local evidence is gone.

References