Security Log Cleared or System Log Cleared

Jorden Smith@Jorden

•updated Feb 10, 2026•3•0•28

This rule detects when the security log (EventCode 1102) or the system log (EventCode 104) is cleared on a Windows machine. This activity can indicate an attempt by an attacker to remove forensic evidence of their actions.