Someone cleared the Security log

A domain controller cleared its Security log at 2 AM. A forwarded copy survived. Use jq on the exported events to see who cleared it and what they did just before.

Terminal mission
Intermediate
4 objectives
0 of 4 solved

Briefing

Event 1102 means the Security log was cleared. The local log on DC01 now starts at record 1, but Windows Event Forwarding had already sent a copy to the collector. You have it as JSON lines from evtx_dump at /cases/dc01-security.jsonl.

Each line is one event. The ID is at .Event.System.EventID. Most fields live under .Event.EventData. Event 1102 keeps its fields under .Event.UserData.LogFileCleared.

analyst@ir-ws

ir-ws · Windows event logs

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@ir-ws:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.