Windows Event Log Cleared

The analytic detects the clearing of Windows event logs by identifying Windows Security Event ID 1102 or System log event 104. This behavior is significant as it may indicate an attempt to cover tracks after malicious activities, hindering forensic investigations and allowing attackers to persist undetected.