Windows Security Eventlog Cleared
This rule detects when a Windows Event Log has been cleared. This activity is often performed by attackers to remove traces of their presence on a compromised system. The rule specifically looks for Event ID 517 from the 'Security' provider or Event ID 1102 from the 'Microsoft-Windows-Eventlog' provider, both of which indicate that an event log has been cleared. This can be caused by commands like 'wevtutil cl' or other methods of log manipulation.
Sigma
