Windows Event ID 1102 — Audit Log Cleared
Logged when the Security event log is cleared. This is one of the clearest signs of an attacker covering their tracks.
MITRE ATT&CK
Technique
T1070.001 · Clear Windows Event Logs
Tactic
Defense Evasion
Why It Matters
Legitimate clearing of the Security log is extremely rare and almost never done in production without prior archiving. Attackers clear logs to erase evidence of their actions. The 1102 event itself is not erasable by the same method, making it a reliable indicator.
Key Fields
Subject Account NameThe account that cleared the log — should be a known admin with a documented reason
Subject Logon IDLinks to the logon session that performed the clear
Investigation Tips
- 1.Treat any unexpected 1102 as a critical incident — other evidence of compromise will now be missing.
- 2.Check what happened just before the clear by looking at other log sources (Sysmon, PowerShell logs, network logs).
- 3.Look for wevtutil.exe or Clear-EventLog in process creation logs (4688) near the same time.
Go deeper: the full Event ID 1102 — Security Audit Log Cleared guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Event ID 1102 — Security Audit Log Cleared guide →See Event ID 1102 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →