Event ID 1102 — Security Audit Log Cleared

MITRE ATT&CK

Security Relevance

Clearing the audit log destroys forensic evidence of what the attacker did before the clear. This is a classic anti-forensics technique used by attackers after gaining admin access. A cleared log means you may have lost visibility into earlier malicious activity including credential attacks, privilege escalation, and persistence installation.

Example Log Entry

Log Name: Security
Source:    Microsoft-Windows-Security-Auditing
Event ID:  1102
Level:     Information

The audit log was cleared.

Subject:
  Security ID:   CORP\j.smith
  Account Name:  j.smith
  Account Domain: CORP
  Logon ID:      0x72A4F

Investigation Steps

1. 1.Identify who cleared the log — was it an expected administrator or an unusual account?
2. 2.Check the logon ID to determine what session cleared the log and where it originated.
3. 3.Look for Event ID 4624 entries before the clear to understand how the account accessed the system.
4. 4.Review other logs (System, Application, PowerShell) that may not have been cleared.
5. 5.Check for Event ID 4688 (process creation) near the time of the clear — wevtutil.exe is commonly used.
6. 6.Assume that activity before the clear may be unrecoverable — document what is known and escalate.

Remediation

• ✓Forward logs to a SIEM or remote syslog server in real time so clearing local logs doesn't destroy all evidence.
• ✓Restrict log-clearing permissions — only specific service accounts should have SeSecurityPrivilege.
• ✓Enable alerting on Event ID 1102 in your SIEM — this should always page an analyst.
• ✓Review audit policy to ensure logs are protected and sized appropriately (minimum 1GB for Security log).
• ✓Investigate the account that cleared the log for signs of compromise.

Related Event IDs

Related Detection Guides