title: Windows Security Audit Log Cleared
id: 47314a5d-b106-4122-9dce-99f9de29c209
status: experimental
description: |
  Detects event 1102, written to the Security log when that log is cleared. The event survives
  the clearing because it is the first record in the new log, and it names the account that did
  it. Almost nobody clears the Security log for an operational reason. ATT&CK v19 moved this
  technique to T1685.005 under Defense Impairment. The tags below keep the earlier T1070.001,
  because that is the identifier Sigma tooling and most SIEM ATT&CK mappings still validate.
references:
  - https://attack.mitre.org/techniques/T1685/005/
  - https://attack.mitre.org/techniques/T1070/001/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-1102
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.defense-evasion
  - attack.t1070.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 1102
    Provider_Name: 'Microsoft-Windows-Eventlog'
  condition: selection
falsepositives:
  - Image preparation before a machine is handed over (sysprep workflows). Should never appear on a machine already in service.
level: high