Windows Event Log Cleared (Microsoft-Windows-Eventlog Event ID 104)

title: Windows Event Log Cleared (Microsoft-Windows-Eventlog Event ID 104)
id: f66ee38a-59a7-4308-a7df-7d1c21a59cb6
related:
  - id: f2f01843-e7b8-4f95-a35a-d23584476423
    type: obsolete
  - id: d99b79d2-0a6f-4f46-ad8b-260b6e17f982
    type: derived
  - id: 100ef69e-3327-481c-8e5c-6d80d9507556
    type: derived
  - id: a62b37e0-45d3-48d9-a517-90c1a1b0186b
    type: derived
status: test
description: This rule flags Windows systems where an Event Log was cleared, indicated by Microsoft-Windows-Eventlog with EventID 104. Clearing logs can hinder investigations and reduce forensic visibility, which is why this behavior is significant for security monitoring. The detection relies on Windows System telemetry from the Microsoft-Windows-Eventlog provider, matching EventID 104 and excluding several commonly covered channels.
references:
  - https://twitter.com/deviouspolack/status/832535435960209408
  - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_eventlog/win_system_eventlog_cleared.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-01-10
modified: 2023-11-15
tags:
  - attack.defense-impairment
  - attack.t1685.005
  - car.2016-04-002
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 104
    Provider_Name: Microsoft-Windows-Eventlog
  filter_main_covered:
    Channel:
      - Microsoft-Windows-PowerShell/Operational
      - Microsoft-Windows-Sysmon/Operational
      - PowerShellCore/Operational
      - Security
      - System
      - Windows PowerShell
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
  - System provisioning (system reset before the golden image creation)
level: medium
license: DRL-1.1