Windows Event Logs Cleared

Jorden Smith@Jorden

•updated Feb 10, 2026•0•19

The rule detects when Windows Event Logs are cleared. Specifically, it looks for Event ID 1102, which indicates the Security log was cleared, or Event ID 104, which indicates the System log was cleared. This activity is often associated with anti-forensics techniques to hide malicious actions.