Windows Event Log Cleared
This rule detects when one of the Windows Event Logs has been cleared. This activity is often performed by adversaries to remove evidence of their presence and actions on a compromised system. The detection specifically looks for Event ID 104 from the 'Microsoft-Windows-Eventlog' provider, which indicates an event log has been cleared. It filters out certain channels that might be covered by other rules to avoid redundancy.
Sigma
