critical Sigma Windows

Windows Event Log Cleared

The Security, System, PowerShell or Sysmon log being cleared. Rarely legitimate outside a change window, and one of the few cases where the missing log is the evidence.

Rule source

event-log-cleared.yml

title: Windows Event Log Cleared
id: c4f7b912-0e35-4a88-b6d2-38f1c0ae5d67
status: stable
description: >
  The Security, System or PowerShell operational log being cleared. Almost never
  legitimate on a server outside a documented maintenance window, and one of the
  few events where absence of the log is itself the evidence.
references:
  - https://attack.mitre.org/techniques/T1070/001/
author: DetectionOps
date: 2026/09/12
logsource:
  product: windows
  service: security
detection:
  selection_security:
    EventID: 1102
  selection_other:
    EventID: 104
    Channel:
      - 'System'
      - 'Microsoft-Windows-PowerShell/Operational'
      - 'Microsoft-Windows-Sysmon/Operational'
  condition: 1 of selection_*
fields:
  - SubjectUserName
  - Channel
  - ComputerName
falsepositives:
  - Documented maintenance that rotates logs - should be an approved change, not an exclusion
level: critical
tags:
  - attack.defense_evasion
  - attack.t1070.001

Required telemetry

Windows Security - Event ID 1102, System - Event ID 104

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Documented maintenance that rotates logs - raise a change record, do not add an exclusion

Validation

wevtutil cl Security in the lab, confirmed 1102 reaches the queue within SLA

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.