Event ID 104: An event log was cleared
Written in the System log when a log other than Security (for example System or Application) is cleared.
- Log
- System
- Category
- Defense evasion
Why it matters
- Often seen alongside 1102 when an attacker clears every log with wevtutil.
What to check
Check which log was cleared and by which account.
How to turn it on
Logged by default.
MITRE ATT&CK
- T1070.001 Clear Windows Event Logs