Security Event log cleared

Checks for event id 1102 which indicates the security event log was cleared. It uses Event Source Name "Microsoft-Windows-Eventlog" to avoid generating false positives from other sources, like AD FS servers for instance.

Detection logic

Detection requirements

Platform: Containers ESXi Linux macOS Network Devices Office Suite Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: securityevents windowsforwardedevents windowssecurityevents
Log source service: securityevent windowsevent

Detection rules

Security Event log cleared

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules