wevtutil Log Clearing / Event ID 1102 Audit Log Cleared

Ibrahim Saud@tektrix

•updated Jul 2, 2026•3•0•14

Detects attempts to clear Windows event logs using the wevtutil utility (clearing Security, System, or Application logs) or the native Windows event log clearing event ID 1102 (The audit log was cleared).