Detection of Windows Event Log Clearing

Clearing Windows event logs is a common technique used by attackers to hide malicious activity, such as persistence establishment, credential theft, or lateral movement, by removing forensic footprints. This activity is identified by the generation of Windows Security Event ID 1102 (audit log was cleared) or System Event ID 104 (log file was cleared). Defenders should treat this as a high-fidelity signal of potential post-compromise activity, as seen in various ransomware campaigns such as Clop and ShrinkLocker. While system administrators may occasionally clear logs for maintenance purposes, unauthorized clearing is a critical red flag that warrants immediate investigation and correlation with other suspicious events on the endpoint.

Impact

Successful clearing of Windows event logs hinders incident response and forensic investigations by destroying historical audit trails. This action is frequently observed during ransomware attacks and unauthorized access attempts to prevent detection and prolong attacker dwell time. Unauthorized log clearing often precedes final-stage payloads like data exfiltration or system encryption, making prompt detection and alerting essential for early intervention.

Recommendation

• Deploy the provided Sigma rule to detect the specific Event IDs associated with log clearing.
• Establish a baseline of authorized administrative activity to reduce false positives generated by system maintenance.
• Integrate endpoint event logs with a SIEM or security analytics platform to facilitate automated alerting and historical data retention, ensuring logs are preserved even if local files are cleared.
• Correlate instances of log clearing with other high-severity alerts such as service manipulation, suspicious process execution, or unauthorized network connections.