↳ GitHub sourceAnalytics ruleMedium

NRT Security Event log cleared

Description

'Checks for event id 1102 which indicates the security event log was cleared. It uses Event Source Name "Microsoft-Windows-Eventlog" to avoid generating false positives from other sources, like AD FS servers for instance.'

Rule type: NRT
Version: 1.0.1
Declared status: Available

Declared MITRE coverage

DefenseEvasion T1070

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

SecurityEvents WindowsSecurityEvents

Data types

SecurityEvent

KQL query

Original query, unchanged.

SecurityEvent
| where EventID == 1102 and EventSourceName == "Microsoft-Windows-Eventlog"
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), EventCount = count() by Computer, Account, EventID, Activity
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(Account, @'\')[1]), AccountNTDomain = tostring(split(Account, @'\')[0])

Declared entities

AccountHost

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Windows Security Events/Analytic Rules/NRT_SecurityEventLogCleared.yaml ↗
Commit: 9800e51 ↗
Source identifier: 508cef41-2cd8-4d40-a519-b04826a9085f

Additional source files 3

Solutions/Windows Security Events/Analytic Rules/NRT_SecurityEventLogCleared.yamlsource ↗Detections/SecurityEvent/NRT_SecurityEventLogCleared.yamlmigration-note ↗Solutions/Windows Security Events/Data/Solution_Windows Security Events.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.