Mass Windows Event Log Clearing via wevtutil / Event ID 1102 (Settra)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•4

This rule detects attempts to clear Windows Event Logs using the 'wevtutil.exe' command-line utility or by identifying the generated Windows Security Event ID 1102 (Audit log was cleared). It tracks multiple instances of log clearing to identify suspicious bulk log deletion activity.