Link Search Menu Expand Document

AD_Audit_Log_Cleared

ID: 100331

Description:

EventID 1102: Audit log was cleared (ID: T1070.001) Ref links: https://attack.mitre.org/techniques/T1070/001/ https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102 https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1102

Repository: Group: WinlogBeat Type: event

Default Status:

Enabled

Tags:
AD
 

Selector:

Query:

Filters:

Field MUST hit
winlog.event_id 1102
@eventType winlogbeat
winlog.channel Security
Field MUST NOT hit
   

Behavior Rule:

Key Type Behavior Category
winlog.computer_name asset security alert

Risks:

Risks Base Score Dimension
ALERT_HIGH_CONFIDENCE 2000 alert

Attributes:

Alias Key
Hostname winlog.computer_name
EventID winlog.event_id
Category winlog.task
Channel winlog.channel
Msg @message

Correlation Rules:

History:

| User | Date | | :— | :— | | — | — |

This page was automatically created/formatted on Tue, 2021 Oct 19 00:29:17 EDT, from rule_dump.json (db47c470500ce8686ead334f5eda0596)