Detections
- ID: DT004
- Created: 25th May 2024
- Updated: 25th May 2024
- Platform: Windows
- Contributor: The ITM Team
Windows System Logging was Cleared
Windows Event Log ID 1102 “The audit log was cleared” is generated when the Windows Security audit log has been cleared. This Event contains the account's SID, name, and domain that cleared the log.
This may represent an anti-forensics technique if there is no reasonable explanation for why the Event Log was cleared on this system.
Sections
| ID | Name | Description |
|---|---|---|
| AF002 | Clear Operating System Logs | A subject clears operating system logs to hide evidence of their activities. |
| AF002.001 | Clear Windows Event Logs | A subject clears Windows Event logs to conceal evidence of their activities. Windows Event Logs store various types of information, such as system errors, application events, security auditing messages, and other operational events. The logs are stored in Windows Event Logs can be cleared using the Event Viewer utility, provided the user account has administrative privileges. |