Windows Security Log Cleared

Ankit Mehta@Secvyn

•updated Jun 24, 2026•0•0•3

This rule detects when the Windows Security Event Log (Event ID 1102) or the System Event Log (Event ID 104) has been cleared. Clearing event logs is a common tactic used by adversaries to remove evidence of their activities on a compromised system.