Sigma rule: Security Eventlog Cleared
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-afab15200ae2, updated 2022-02-24T00:00:00.000Z.
Rule
- Title
- Security Eventlog Cleared
- Status
- test
- Level
- high
- Author
- Florian Roth (Nextron Systems)
- Date
- 2017-01-10
- Modified
- 2022-02-24
- File
- rules/windows/builtin/security/win_security_audit_log_cleared.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution
Log source
- product
- windows
- service
- security
Detection
selection_517:
EventID: 517
Provider_Name: Security
selection_1102:
EventID: 1102
Provider_Name: Microsoft-Windows-Eventlog
condition: 1 of selection_*False positives (as the rule lists them)
- Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
- System provisioning (system reset before the golden image creation)
Tags
- attack.defense-impairment
- attack.t1685.005
- car.2016-04-002
MITRE ATT&CK ids this rule names
Related rules
- f2f01843-e7b8-4f95-a35a-d23584476423 (obsolete)
- a122ac13-daf8-4175-83a2-72c387be339d (obsolete)
References
- https://twitter.com/deviouspolack/status/832535435960209408
- https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100
- https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/SecurityEventLogCleared.yaml
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_audit_log_cleared.yml
Sources and licences
SigmaHQ
"Security Eventlog Cleared" by Florian Roth (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_audit_log_cleared.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Security Eventlog Cleared",
entity page, dataset version ref-afab15200ae2, updated 2022-02-24T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/d99b79d2-0a6f-4f46-ad8b-260b6e17f982 (accessed 2026-11-03).
Underlying source: SigmaHQ rule d99b79d2-0a6f-4f46-ad8b-260b6e17f982, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.