Tools · Windows security and Event Logs · 06 / 27
Event ID 1102 and 104: detecting cleared Windows event logs
Recognize when the Security or other logs were cleared, find who did it, and make sure the evidence already left the machine.
Two events for two kinds of logs
Event 1102 in the Security log means “The audit log was cleared.” It records the account that cleared it. Event 104 in the System log records that another log, such as System or Application, was cleared. Both are written even though the rest of the log is gone, because the clear operation itself is logged first.
Clearing logs is rare in normal administration. When it happens on a workstation or server outside a documented maintenance task, treat it as a likely attempt to hide activity.
How logs get cleared
Event Viewer has a Clear Log action. wevtutil cl Security clears from the command line. PowerShell’s Clear-EventLog clears classic logs. All of them need administrator rights and all produce 1102 or 104.
Some attackers stop the EventLog service or tamper with individual records instead, which does not always produce 1102. Gaps in the record sequence and a stopped EventLog service (System log 7036 or 7040) are the signs to look for.
Lab: clear and detect
On a lab VM, generate a few logon events, then clear the Security log with wevtutil. Open the new Security log and find 1102 with the subject account. Clear the Application log too and find 104 in System.
If the VM forwards logs to a collector, confirm the events from before the clear are still there. That is the whole point of forwarding.
wevtutil cl Security
wevtutil cl Application
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} -MaxEvents 1 | Format-List TimeCreated, Message
Get-WinEvent -FilterHashtable @{LogName='System'; Id=104} -MaxEvents 5 | Format-Table TimeCreated, Message -WrapMake clearing pointless
Forward Security, System, PowerShell, and Sysmon logs to a central collector with Windows Event Forwarding or an agent. Alert on every 1102 and 104 centrally. Restrict who holds local administrator rights so fewer accounts can clear logs at all.
Size logs large enough that they are not overwritten in hours. A tiny Security log that rolls over constantly erases evidence without anyone clearing it.
Diagram
Local-only logs versus forwarded logs
What survives a clear.
After wevtutil cl. Only 1102 remains.
Investigation. Activity before the clear is lost.
Detection. Depends on someone looking at the host.
After wevtutil cl. Central copy is intact.
Investigation. Full timeline available.
Detection. 1102 raises a central alert.
Check yourself
1. Which event shows the Security log was cleared?
2. Where does Event 104 appear?
3. What makes clearing local logs much less effective for an attacker?