Security Log Cleared by Non-System Account
Detects when the security event log has been cleared by an account that is not the built-in system administrator (SID ending in 500). This activity is often performed by adversaries to remove traces of their actions.
Microsoft Sentinel (KQL)
