Yahoo Web Search

Search results

1. • Clearing the audit log

     • Windows security event log ID 1102 Event 1102 relates to clearing the audit log. You should never see event 1102 in your audit logs unless you have cleared the log intentionally. Attackers often clear audit logs to cover their tracks. You’ll want to know what user cleared the log as this will be an indicator of account takeover.
     www.csoonline.com › article › 569481

     The most important Windows 10 security event log IDs to ...

2. People also ask

   Why is event ID 1102 logged?

   • Whenever Windows Security audit log is cleared, event ID 1102 is logged. Why does event ID 1102 need to be monitored? Typically, there is no need for manual clearing of the event log, so the occurrence of this event must be further investigated.

   Event ID 1102 - The audit log was cleared - ManageEngine

   www.manageengine.com/products/active-directory-audit/kb/event-log-events/event-id-1102.html

   See all results for this question

   What is event 1102?

   • Event 1102 relates to clearing the audit log. You should never see event 1102 in your audit logs unless you have cleared the log intentionally. Attackers often clear audit logs to cover their tracks. You’ll want to know what user cleared the log as this will be an indicator of account takeover.

   The most important Windows 10 security event log IDs to monitor

   www.csoonline.com/article/569481/the-most-important-windows-10-security-event-log-ids-to-monitor.html

   See all results for this question

   Should I see event 1102 in my audit logs?

   • You should never see event 1102 in your audit logs unless you have cleared the log intentionally. Attackers often clear audit logs to cover their tracks. You’ll want to know what user cleared the log as this will be an indicator of account takeover. You may even want to set up an alert when this event occurs.

   The most important Windows 10 security event log IDs to monitor

   www.csoonline.com/article/569481/the-most-important-windows-10-security-event-log-ids-to-monitor.html

   See all results for this question

   What is event ID 4104?

   • Note: Event ID 4104 (from the Microsoft-Windows-Powershell/Operational log) captures Powershell script blocks, which can be analyzed and used to detect on attempts to Clear Windows Event Logs. In particular, Powershell has a built-in Clear-EventLog cmdlet that allows for a specified log to be cleared.

   Indicator Removal: Clear Windows Event Logs - MITRE ATT&CK®

   attack.mitre.org/techniques/T1070/001/

   See all results for this question

3. learn.microsoft.com › auditing › event-11021102 (S) The audit log was cleared. - Windows 10 | Microsoft ...

   learn.microsoft.com › auditing › event-1102

   • Cached

   Sep 7, 2021 · There is no need to manually clear the Security event log in most cases. We recommend monitoring this event and investigating why this action was performed. Though you shouldn't normally see it, this event generates every time Windows Security audit log is cleared. This is for event 1102 (S).

4. www.ultimatewindowssecurity.com › securitylogWindows Security Log Event ID 1102 - The audit log was cleared

   www.ultimatewindowssecurity.com › securitylog

   • Cached

   Event 1102 is logged whenever the Security log is cleared, REGARDLESS of the status of the Audit System Events audit policy. The Account Name and Domain Name fields identify the user who cleared the log. Logon ID allows you to correlate backwards to the logon event as well as with other events logged during the same logon session.

   • Category• Subcategory: Non Audit (Event Log)• Log clear
   • Type: Success

   • Corresponding eventsin Windows 2003and before: 517

5. www.csoonline.com › article › 569481The most important Windows 10 security event log IDs to ...

   www.csoonline.com › article › 569481

   • Cached

   Jun 17, 2020 · Windows security event log ID 1102. Event 1102 relates to clearing the audit log. You should never see event 1102 in your audit logs unless you have cleared the log intentionally....

6. attack.mitre.org › techniques › T1070Indicator Removal: Clear Windows Event Logs - MITRE ATT&CK®

   attack.mitre.org › techniques › T1070

   • Cached

   Monitor for unexpected deletion of Windows event logs (via native binaries) and may also generate an alterable event (Event ID 1102: "The audit log was cleared"). When an eventlog is cleared, a new event is created that alerts that the eventlog was cleared.

   Id	Name	Description
   G0007	APT28	APT28 has cleared event logs, including ...
   G0050	APT32	APT32 has cleared select event log ...
   G0082	APT38	APT38 clears Window Event logs and Sysmon ...
   G0096	APT41	APT41 attempted to remove evidence of ...

   See full list on attack.mitre.org

7. www.ultimatewindowssecurity.com › securitylogWindows Security Log Encyclopedia

   www.ultimatewindowssecurity.com › securitylog

   • Cached

   Windows: 1100: The event logging service has shut down: Windows: 1101: Audit events have been dropped by the transport. Windows: 1102: The audit log was cleared: Windows: 1104: The security Log is now full: Windows: 1105: Event log automatic backup: Windows: 1108: The event logging service encountered an error : Windows: 4608: Windows is ...

8. www.manageengine.com › event-id-1102Event ID 1102 - The audit log was cleared - ManageEngine

   www.manageengine.com › event-id-1102

   • Cached

   Event 1102 applies to the following operating systems: Windows 2008 R2 and 7. Windows 2012 R2 and 8.1. Windows 2016 and 10. Corresponding event ID in Windows 2003 and earlier is 517. Explore Active Directory auditing and reporting with ADAudit Plus.