Detecting Event Log Clearing: Event 1102, 104 and wevtutil

Wiping Windows event logs is one of the oldest anti-forensic moves, and it is still routine in ransomware intrusions. Windows records the act itself: Security Event 1102 and System Event 104 are written after a clear. The detection problem is less about spotting the clear and more about making sure the evidence already left the host.

Signals at a Glance

The Clear Events

Event 1102 is written to the Security log with the account that performed the clear; Event 104 is its System-log counterpart for other channels such as PowerShell Operational or Sysmon. Both are cheap, near-zero-false-positive alerts. In KQL against forwarded Security events:

// Microsoft Sentinel (KQL) - any log clear, with who and from where
let cleared = SecurityEvent
| where EventID == 1102
| project TimeGenerated, Computer, Account = SubjectUserName, Channel = "Security";
let others = Event
| where EventID == 104 and Source == "Microsoft-Windows-Eventlog"
| extend Channel = tostring(parse_xml(EventData).DataItem.UserData.LogFileCleared.Channel)
| project TimeGenerated, Computer, Account = UserName, Channel;
cleared
| union others
| order by TimeGenerated desc
// tune/validate: suppress known golden-image builds and lab hosts by name.

The command-line route is just as telling, and it fires even when the attacker later removes the event. Sigma for the common utilities:

title: Windows Event Log Cleared via Command Line
logsource:
  product: windows
  category: process_creation
detection:
  wevtutil:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains:
      - ' cl '
      - 'clear-log'
  powershell:
    CommandLine|contains:
      - 'Clear-EventLog'
      - 'Remove-EventLog'
      - 'ClearLog('
  condition: wevtutil or powershell
level: high
# tune/validate: allow patching scripts that rotate custom channels.

Preserving the Evidence

A detection that fires after the logs are gone is a notification, not a defence. The control that matters is moving events off the host quickly, so a clear removes only a few seconds of local data.

• Forward Security, System, PowerShell Operational and Sysmon channels with Windows Event Forwarding or an agent, with a delivery lag measured in seconds.
• Alert when forwarding stops: a host whose last event time freezes right after a 1102 or 104 is almost certainly under attack, not misconfigured.
• Include the actor: pull SubjectUserName and logon ID from Event 1102, then pivot to the 4624 logon that created that session.
• Remember individual-entry deletion tools exist; compare record IDs for gaps if you suspect surgical removal rather than a full clear.