Windows SecurityPolicy Change

Event 1102: The audit log was cleared.

The audit log was cleared (typically the security log).

Technical Details

Windows Security Source

Event ID: 1102

Windows Security- Policy Change

Event Description

The audit log was cleared (typically the security log).

Key Log Fields

  • SubjectUserName - Account that cleared the audit log
  • SubjectDomainName - Domain of the account
  • SubjectLogonId - Logon ID for correlation

MITRE ATT&CK® Mapping (1)

T1070.001defense-evasion
Clear Windows Event Logs

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: * <code>wevtutil cl system</code> * <code>wevtutil cl application</code> * <code>wevtutil cl security</code> These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command <code>Remove-EventLog -LogName Security</code> to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging) Adversaries may also attempt to clear logs by directly deleting the stored log files within `C:\Windows\System32\winevt\logs\`.

Contents