Event ID 1102: The audit log was cleared
Written to the Security log when it is cleared, with the account that did it.
- Log
- Security
- Category
- Defense evasion
Why it matters
- Clearing the Security log is rarely legitimate on a production system and is a classic attacker clean-up step.
- It is always logged, even if other auditing is turned off.
What to check
Check who cleared it and what happened on the host just before; collect forwarded copies of the log if you have them.
How to turn it on
Always written; no audit policy needed.
MITRE ATT&CK
- T1070.001 Clear Windows Event Logs