Link Search Menu Expand Document

AD_Audit_Log_Cleared

ID: 100272

Description:

EventID 1102: Audit log was cleared (ID: T1070.001)

Ref links: https://attack.mitre.org/techniques/T1070/001/ https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102 https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1102

Repository: Fluency Group: AD Type: event

Default Status:

Enabled

Tags:
AD
 

Selector:

Query:

Filters:

Field MUST hit
@fields.EventID 1102
@eventType nxlogAD
@fields.Channel Security
Field MUST NOT hit
   

Behavior Rule:

Key Type Behavior Category
@fields.Hostname asset security alert

Risks:

Risks Base Score Dimension
ALERT_HIGH_CONFIDENCE 2000 alert

Attributes:

Alias Key
Hostname @fields.Hostname
EventID @fields.EventID
EventType @fields.EventType
Category @fields.Category
Channel @fields.Channel
Msg @message

Correlation Rules:

History:

User Date
ho*d@fluencysecurity.com 2021 Jul 15 14:03:34 EDT
ho*d@fluencysecurity.com 2021 Sep 29 17:18:07 EDT

This page was automatically created/formatted on Tue, 2021 Oct 19 00:29:17 EDT, from rule_dump.json (db47c470500ce8686ead334f5eda0596)